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Errata 
Sniffer Advanced Token Ring Monitor User’s Manual 
January 16, 1991 


The following errata apply to the Sniffer Advanced Token Ring Monitor User’s Manual. The corrections are indicated 
with italics. 


N 


Nw 


On Page 81, in Chapter 6, under “Interpreting Alarms When Using Monitor Filters,” the first bulleted paragraph 
reads: 


s If Monitor filters is set to MAC frames or All frames, the Token Ring Monitor does not generate an idle 
alarm for a host computer on the network that fails to transmit LLC frames. The Token Ring Monitor gen- 
erates the alarm only when the adapter in that station fails to transmit MAC frames or any frame at all 
within the time specified by the idle alarm threshold. 


This paragraph should read: 


. If Monitoring filters is set to MAC frames or All frames, the Token Ring Monitor does not generate an 
idle alarm for a host computer on the network as long as its adapter transmits MAC frames. In this case 
you will not be notified if the station fails to transmit an LLC frame. 


On page 188, in Appendix C, under “From, To, and Both Fields,” the second and third paragraphs read: 


Partner When used as a From field, Partner is the name of the station that this station most 
recently received traffic from. The code is FPARTNER. 


When used as a To field, Partner is the name of the station that this station most 
recently transmitted traffic to. The code is TPARTNER. 


These paragraphs should read: 


Partner When used as a From field, Partner is the last station that has received traffic from 
this station. The code is FPARTNER. 


When used as a To field, Partner is the last station that sent traffic to this station. The 
code is TPARTNER. 


Sniffer Advanced Token Ring Monitor Known Display Errors 
January 16, 1991 


When using Token Ring Monitor, stations leaving the ring suddenly may be classified as remote in the station 
Status display. This response is transient and will be corrected when the monitor detects a MAC packet from that 
station. 


When you select display/routing info/route lengths, the statistics displayed under “other” and “total” are incor- 
rect because they include frames to group and inactive addresses. 
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Manual Overview 


™ 


Welcome to the Sniffer” Advanced Token-Ring Network Monitor, the advanced 
network monitoring program that uses state-of-the-art data collection techniques. 


This manual describes how to activate, configure, and operate the Token-Ring Monitor. It 
also describes the Token-Ring Monitor's various features and provides recommendations 
on how to use them. The manual has been prepared with the assumption that you are a 
token-ring network manager who understands how a token-ring network operates 
according to the IBM® Token Ring and IEEE 802.5 specifications. It also assumes that you 
are familiar with DOS. 


This manual corresponds to the Token-Ring Monitor software version 1.20. If the product 
shipment includes a release note, the information in the note supersedes the information 
in this manual. Also, if the software diskette in the shipment contains a README file, be 
sure to read the file because it provides up-to-date information on the Token-Ring 
Monitor. 


How to Use this Manual 


To help you find procedures easily, the Table of Contents contains a separate listing for 
procedures. The “Recommendations” entry in the Index points you to suggestions for 
getting the most from your Token-Ring Monitor software. 


The manual is organized as follows: 


* Chapter 1 provides an overview of the product. Chapters 2 through 7 contain step-by- 
step procedures for all major tasks. Follow the procedures in these chapters to become 
familiar with the Token-Ring Monitor. 


* When you are ready to monitor your network, read Chapter 8 for recommendations 
on how to use the Token-Ring Monitor efficiently. 


* Chapters 1 through 8, however, do not explain all the terms used in the screen display. 
They are discussed in Chapter 10, “The Token-Ring Monitor Menu Items.” 


* Chapter 9 describes the Token-Ring Monitor files. It provides information on the 
contents of the files and when the files are read and written. 


* The appendixes provide additional information that includes a list of error and 
warning messages, a list of command line options, and definitions of the fields that 
you can insert in report scripts. 


* The bibliography lists the books that this manual refers to. 
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Conventions Used in this Manual 
The following describes the conventions used in this manual: 
Bold Menu options and names of keys are in bold type. For example: 
Move to Display in the main menu and then press Enter. 


UPPERCASE The filenames and command names you type at a DOS prompt are in 
uppercase. In addition, the command you should type is printed in bold. 
For example: 


Type INSTALL to copy the files. Then modify the AUTOEXEC.BAT file. 
Italics Variables, for which you insert values, are in italics. For example: 


Type the number of minutes and seconds in the mm:ss format. 


“n 


System prompts and messages are in quotation marks. For example: 


If a monitoring session is in progress, the message “ You must stop 
monitoring before you can use this feature” appears. 


Hexadecimal numbers mentioned in the manual are followed by “(hex)”; numbers 
without any notations are decimal. For example, “The maximum number of stations is 75. 
The default memory address is D8000 (hex).” 


This manual uses “the Token-Ring Monitor” to refer to the Sniffer Advanced Token-Ring 
Network Monitor. The term “PC” refers to the Sniffer analyzer that the Token-Ring 


Monitor runs on. A “view” refers to a statistical display generated by the Token-Ring 
Monitor. 


Product Support 


If you encounter any problems when using the Token-Ring Monitor, contact Technical 
Support at Network General at 415/688-2700 from Monday through Friday, 6:00 a.m. to 
6:00 p.m., Pacific time. Have your Sniffer analyzer’s serial number ready when you call. 
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Product Overview 


Chapter 1. Product Overview 


The Token-Ring Monitor is a network monitoring program that runs on a Sniffer® 
analyzer containing an IBM Token-Ring Network 16/4 Adapter. This chapter summarizes 
the features of the Token-Ring Monitor, describes how the Token-Ring Monitor works, 
and lists the system requirements for running the Token-Ring Monitor. 


What the Token-Ring Monitor Can Do 


The Token-Ring Monitor provides an accurate picture of network activity at any moment 
ora historical record of network activity over a period of time. This information helps you 
find traffic overloads, plan for network expansion, detect intruders, establish performance 
baselines, and distribute traffic more efficiently between servers and subnets. 


The Token-Ring Monitor's report capabilities let you communicate this information to 
others, complete with graphs and tables. The Token-Ring Monitor’s alarm capabilities 
alert you to problems with the network or with individual stations before users call you to 
complain. 


The following list summarizes the capabilities of the Token-Ring Monitor: 


* Monitors up to 1,024 network stations at data rates of up to 3,000 frames per second 
* Generates visible and audible alarms for the entire network or for individual stations 
* Compiles a historical alarm log 


* Provides real-time traffic and historical information for individual stations as well as 
for the entire network 


¢ Sorts statistics to show only those items that interest you 
* Creates customized management reports 


* Helps to identify faulty hardware and software. 


Typical Application 


The Token-Ring Monitor only monitors frames on the token-ring network segment to 
which the Sniffer analyzer’s network interface card is attached. However, the Token-Ring 
Monitor indicates the amount of internetwork traffic in some of its displays. 


The Token-Ring Monitor complies with the IBM Token Ring and IEEE 802.5 standards. 
Figure 1 shows how the Token-Ring Monitor is typically used on a token-ring network. 
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Network Stations 


Network B 


OR ei The Token-Ring Monitor on this 

Sniffer analyzer monitors the 

eR traffic on Network A. It also 

Sniffer Analyzer provides statistics related to 

traffic routed by the token-ring 
bridge. 


Figure 1. A Sniffer analyzer running the Token-Ring Monitor on a token-ring network. 


How the Token-Ring Monitor Works 


This section briefly describes how the Token-Ring Monitor works. Refer to the appropriate 
chapters for detailed information on activating, configuring, and operating the Token- 
Ring Monitor. 


To use the Token-Ring Monitor, simply activate the Token-Ring Monitor Selection menu 
and select the Run Token-Ring Monitor option to start the monitor. The monitor then 
loads TRMONDRYV to memory, which is a background program for monitoring network 
traffic. It also activates the TRMON program, a foreground program that displays the 
monitor’s main menu for you to access various functions of the monitor (for example, 
displaying alarms or routing information). Once the main menu is displayed, you can start 
a monitoring session. 


During a monitoring session, the Token-Ring Monitor monitors all network traffic by 
reading the destination and source addresses of all frames, maintaining counts, and 
generating alarms. You can continue to use the various features of the Token-Ring 
Monitor. For example, you can display statistics and create reports. Alternatively, you can 
run another application in the foreground, and monitor the network in the background. 


TRMONDERY stays in memory until you terminate it. If it is removed from memory when 
a monitoring session is in progress, all statistics that have been gathered during that 
session will be lost. 


System 


Product Overview 


Note: The Token-Ring Monitor does not inform you if it is losing packets from the 
network. This happens when the traffic on the token ring exceeds about 3,000 frames per 
second. 


Requirements 


The Token-Ring Monitor only runs on a Token-Ring Sniffer analyzer that contains an IBM 
Token-Ring Network 16/4 Adapter. 


If you want to use the features that use NetBIOS or NetWare®, you must have a network 
operating system that supports the NetBIOS interface or NetWare. Also, a second network 
interface card that runs these protocols must be present in the Sniffer analyzer. 


Caution: If you are running the IBM LAN Manager on the network, you must set its Trace 
Option to “All” in order for the Token-Ring Monitor to monitor the network. This setting 
allows all adapters to trace frames. Without this setting, the LAN Manager will remove the 
Token-Ring Monitor from the network. For further information on how to set the option, 
refer to IBM’s documentation on LAN Manager. (The LAN Manager described here is a 
program from IBM that manages a local area network; it is not the LAN Manager 
developed by Microsoft®, which is part of an operating system.) 
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Chapter 2. Installation and Configuration 


If you purchase a Token-Ring Sniffer analyzer, the Token-Ring Monitor software is 
already stored on the hard disk. Simply go to “Configuring the Token-Ring Monitor” in 
this chapter for examining and modifying the configuration settings. 


If you receive the Token-Ring Monitor software as an update, go to “Installing the Token- 
Ring Monitor to the Sniffer Analyzer” for software installation instructions. Then go to 
“Configuring the Token-Ring Monitor” for configuration information. 


Installing the Token-Ring Monitor to the Sniffer Analyzer 


You must install the Token-Ring Monitor software contained in the distribution diskette 
to your Sniffer analyzer. After installation, you can access the Token-Ring Monitor from 
the Sniffer analyzer’s Main selection menu. The PC mentioned in the procedure is the one 
on which you currently run the Sniffer analyzer. 


To install the Token-Ring Monitor on the PC: 


1. Stop any network analysis or monitoring activities on the Sniffer analyzer and return 
to DOS. 


2. Insert the distribution diskette in drive A. 
3. Ifthe A> prompt does not appear, type A: and press Enter. 


4. Atthe A> prompt, type INSTALL and press Enter. The Token-Ring Monitor 
Installation Menu appears as shown in Figure 2. 
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Sniffer series/300 Toshiba 3200 SX 
snitrer es/200 [Compaq 386/ 20] 
s/700 [IBM PS/2 } Model 70] 


Sus keys to select, then press Enter. | 


Figure 2. Token-Ring Monitor Installation Menu. 


5. The menu lists different types of Sniffer analyzers. Use the cursor keys to move to the 
option that corresponds to the type of Sniffer analyzer you are using and press Enter. 
The PC starts copying the files from the diskette and displays a list of messages 
indicating which files are being copied. 


When the installation is complete, the following messages appear: 


““* Installation Completed***” 
“Re-boot the Sniffer to start using the Advanced Token-Ring Monitor.” 


6. Remove the distribution diskette from drive A. Then reboot the PC. 


After installation, the Sniffer analyzer’s Main selection menu now includes the Token- 
Ring Monitor option; the directories C:\TRSNIFF and C:\CAPTURE\TRREPT contain 
the files used by the Token-Ring Monitor. These files are described in Chapter 9. 


Installation and Configuration 


Configuring the Token-Ring Monitor 


Configuring the Token-Ring Monitor includes changing the network card settings to 
avoid conflicts within the PC and changing the monitor settings to customize the Token- 
Ring Monitor to your network's needs. 


If you purchase a Token-Ring Sniffer analyzer, the software and network interface card 
are properly configured at the factory. If you receive an update, the software is configured 
to operate with the network interface card as originally configured at the factory. Examine 
these settings in the Configuration Options view to determine whether you need to 
modify them. 


To display the Configuration Options view: 


1. From the Sniffer analyzer’s Main selection menu, move to the Token-Ring Monitor 
option and press Enter. The Token-Ring Monitor Selection menu appears as shown in 
Figure 3. 


Use arrow keys to select, then press Enter. 


Figure 3. Token-Ring Monitor Selection menu. 


2. Move to Configure Token-Ring Monitor and press Enter. The Configuration Options 
view appears. On a Series 300 or 500 Sniffer analyzer, the Configuration Option view 
is similar to the one shown in Figure 4; on a Series 700 Sniffer analyzer, Card Position 
is the only setting under Network Card Settings. 
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Figure 4. Configuration Options view. 


To modify the settings, go to the next section. “Using the Configuration Options View” 
describes how various keys work in the Configuration Options view. The sections 
“Network Card Settings” and “Monitor Settings” explain the meanings of the settings and 
their possible values. 


If you run the Token-Ring Monitor on a Series 700 Sniffer analyzer, it automatically tests 
the network card when it is powered on. If you install the Token-Ring Monitor on a Series 
300 or Series 500 Sniffer analyzer, run a test on the network card after you finish modifying 
the settings according to the instructions in “Testing the Network Interface Card.” 


Using the Configuration Options View 


The following list describes how to select and modify option values within the 
Configuration Options view: 


Use the cursor keys to move to the setting you want to change. The option selected and 
its value are highlighted, and a brief description of that option is displayed near the 
bottom of the window. 


Press Enter to display a list of options or a dialog box that lets you enter a value. 


When the list of options appears, use the cursor keys to move to the desired value. To 
select the value, press Enter. 


If a dialog box appears, type the value and press Enter. 
Press Esc if you decide not to change the value and close the list or dialog box. 


Press F9 (Undo changes) to undo all changes made since you invoked the 
Configuration Options view. 
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* Press F10 (Exit) to leave the Configuration Options view. The Token-Ring Monitor 
saves all your changes when you leave the Configuration Options view. 


Network Card Settings 


The network card settings used by the token-ring network interface card must be unique; 
that is, no other cards in your PC or devices attached to your PC should use the same 
settings. You need not change the settings unless they conflict with other devices. The 
following list describes the network card settings in the Configuration Options view. (If 
you are using a Series 700 Sniffer analyzer, the view contains only one network card 
setting, Card Position.) 


Card Position 


Memory Address 


Monitor Settings 


Specifies whether the token-ring network card is the primary or 
alternate network card. The setting must match the hardware 
configuration on the card. 


The possible values are Primary and Alternate. The default is Primary. 


This setting applies to the Series 300 and Series 500 Sniffer analyzers 
only. It specifies the starting address of the shared random-access 
memory (RAM) that resides on the network interface card, which is 
used to send data between the network and the PC. 


The possible memory base address ranges from 80000 to F3000 (hex). 
The default is D8000. The value you enter must be a multiple of 1000 
(hex). 


Be sure that the memory address does not overlap the read-only 
memory (ROM) address, which is determined by the switch settings 
on the network interface card. 


The following list describes the monitor settings: 


Maximum Stations Determines the maximum number of stations that can be monitored. 


History Length 


The possible value ranges from 1 to 1,024. The default is 1,024. 


Determines the number of history intervals for which the Token-Ring 
Monitor stores history statistics. For example, if you specify that each 
history interval is 15 minutes (“Specifying History Interval” in 
Chapter 3 describes how to set this value), and that History Length is 
20, the Token-Ring Monitor stores statistics for the last 20 time 
periods, each of which is 15 minutes. The possible value ranges from 
5 to 1,750. The default is 100. 


The following is a list of guidelines for changing the monitor settings: 


¢ Initially, set Maximum Stations to a value that is 10% to 20% higher than the number 
of current stations, to allow for growth and for the needs of the Token-Ring Monitor 
software. A token-ring network segment supports up to approximately 250 stations. 


* Each group address is regarded as a station. When setting Maximum Stations for the 
first time, you should assume that there are about 10 to 20 group addresses on the 
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network. After monitoring the network for several days, you will know the actual 
number of group addresses, and you can adjust the maximum number of stations 
accordingly. 


* Remember to count remote stations when setting Maximum Stations. 


* Increasing the number of stations to be monitored or collecting more intervals 
increases the amount of RAM used by the TRMONDRV program. This reduces the 
amount of RAM available for other foreground programs. (TRMONDRV allocates 
about 60 bytes to each station and about 40 bytes to each history interval.) 


Testing the Network Interface Card 


This section applies to the Series 300 and Series 500 Sniffer analyzers only. After you finish 
changing the network card and monitor settings, press F2 to test whether the network card 
can operate with the new values. 


If the new values pass the tests, the Token-Ring Monitor displays “Passed all tests.” If 
there is a problem, a dialog box identifies the problem setting so that you can modify it. 
Refer to Appendix A, “Error and Warning Messages,” for information on system 
messages. Change the setting in the Configuration Options view or the network interface 
card configuration before testing again. 


Example of Changing Configuration Options 


The following is an example showing how you change the settings in the Configuration 
Options view on a Series 500 Sniffer analyzer. Use the values that are appropriate to your 
PC and network instead of the ones in the example when you are changing the 
configuration options. The example assumes that the Configuration Option view is 
already displayed on the screen. 


1. The setting for Card Position is highlighted. To accept the default value (Primary) and 


go to the next option setting, press Cursor Down. The setting for Memory Address is 
highlighted. 


2. Press Enter. A dialog box appears as shown in Figure 5. 
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Figure 5. Dialog box for setting the memory base address. 


Type D0000 and press Enter. If you make a typing mistake, use the cursor keys to move 
the cursor to the desired place to make the correction. If you do not want to change the 
setting after the dialog box appears, press Esc to close the box. 


The new value, D0000, appears as the value of Memory Address. 


Press Cursor Right and then Cursor Up to highlight Maximum Stations. 


Press Enter. A dialog box appears as shown in Figure 6. 
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Figure 6. Dialog box for setting the maximum number of stations. 


Type the number of maximum stations and press Enter. The new value appears in the 
Configuration Options view. 


Press Cursor Down to highlight History Length. 


Press Enter. A dialog box appears as shown in Figure 7. 
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Figure 7. Dialog box for setting the history length. 


. Type 150 and press Enter. The new value appears in the Configuration Options view. 


. Press F2 to run the card test. The Token-Ring Monitor then displays “Testing network 
card.” If the settings pass the tests, the message “Passed all tests” appears. 


If an error message appears, press any key to go back to the Configuration Options 
view. Then reset the values and if necessary, change the configuration of the network 
interface card. Repeat this step to run the card test. 


. Press F10 to leave the Configuration Options view. The values you defined in this 


procedure are stored to C:\ TRSNIFF\TRMON.CEG, and the Token-Ring Monitor 
Selection menu appears. 
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Getting Started 


Chapter 3. Getting Started 


You can specify how the Token-Ring Monitor monitors the network and collects statistics 
by modifying the option settings presented on the main menu. The Token-Ring Monitor 
is shipped with default option settings that you can use to start a monitoring session. 
However, it may become necessary to customize these option settings to suit the needs of 
your network. Also, you should familiarize yourself with these options so that you can 
interpret and use the statistics efficiently. 


This chapter describes the minimum amount of configuration for a monitoring session. 
Refer to the following chapters if you want to customize the Token-Ring Monitor further. 
This chapter also describes how to run the Token-Ring Monitor in the background. 


Outline of the Getting-Started Procedure 
The following list outlines the steps for getting started with the Token-Ring Monitor: 


1. Runthe Token-Ring Monitor demonstration program. (This step is recommended but 
not necessary.) 


2. Start the Token-Ring Monitor program. 

3. Specify the speed of the network. 

4. Specify whether the Token-Ring Monitor monitors all stations or a particular station. 
5. Specify the types of frames to be monitored. 

6. Specify the station for which history statistics are to be collected. 

7. Start a monitoring session. 


The following sections describe these tasks in detail. 


Using the Token-Ring Monitor Demonstration Program 


The Token-Ring Monitor demonstration program uses simulated network traffic to 
demonstrate many of the monitor’s functions. 


To start the demonstration program: 


1. From the Sniffer analyzer’s Main selection menu, move to Token-Ring Monitor and 
press Enter. The Token-Ring Monitor Selection menu appears. (Figure 3 in Chapter 2 
illustrates the Token-Ring Monitor Selection menu.) 


2. Move to Demo Token-Ring Monitor on the Token-Ring Monitor Selection menu and 
press Enter. The initialization screen appears as shown in Figure 8. 
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Figure 8. Initialization screen for the demonstration program. 


Press any key to start the program. The screen shown in Figure 9 appears. 
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Figure 9. Main menu. 


Getting Started 


You are now ready to use the demonstration program to see the various Token-Ring 
Monitor features. To simulate a monitoring session, press F10. The following message 
appears: 


“The Sniffer Network Monitor will enter the ring at 4 Mbit/s. Press ENTER to 
proceed. Press ESC to cancel.” 


Press Enter to proceed regardless of the speed of your token-ring network. The 
demonstration program does not affect your network. 


Now you are ready to move through the menus and view the statistics as if you were 
in a real monitoring session. Refer to “Interacting with the Token-Ring Monitor” later 
in this chapter for information on the user interface. 


Some features are not available in the demonstration program. For example, you 
cannot use the Monitor filters option in the demonstration program. 


When you are finished with the demonstration program, press Cursor Down to move 
to the Exit option in the main menu and then press Enter. The Sniffer analyzer’s Main 
selection menu appears. 
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Note: You must start and stop the Token-Ring Monitor from the Token-Ring Monitor 
Selection menu rather than from the DOS command line. Activating the Token-Ring 
Monitor from the selection menu ensures that system configuration information is 
updated, thereby ensuring proper operation of the Token-Ring Monitor and the Sniffer 
analyzer. 


Removing TRMONDRV from Memory 
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Once you start the Token-Ring Monitor, the TRMONDRV program becomes resident in 
memory. The Token-Ring Monitor Selection menu no longer contains the Configure 
Token-Ring Monitor option. Also, the menu now contains the Terminate Token-Ring 
Monitor option, as shown in Figure 13. 


Figure 13. The Terminate Token-Ring Monitor option. 


You must remove the TRMONDRV program from memory if you want to do any of the 
following: 


* Configure the Token-Ring Monitor 


* Use other functions of the Sniffer analyzer. 


You might also want to remove TRMONDRYV to make room for other applications when 
you no longer need to monitor the network. 


To remove the TRMONDRYV program from memory, choose Terminate Token-Ring 
Monitor on the Token-Ring Selection menu and press Enter. The message “Removing the 
monitor driver from memory...” appears. Then the Sniffer analyzer’s Main selection menu 
is displayed. 


Getting Started 


Version 1.20 


Initialization in progress 


Figure 11. Initialization screen. 


Press any key to display the main menu, which is illustrated in Figure 9. 
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Figure 12. Main menu. 
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Note: You must start and stop the Token-Ring Monitor from the Token-Ring Monitor 
Selection menu rather than from the DOS command line. Activating the Token-Ring 
Monitor from the selection menu ensures that system configuration information is 
updated, thereby ensuring proper operation of the Token-Ring Monitor and the Sniffer 
analyzer. 


Removing TRMONDRV from Memory 
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Once you start the Token-Ring Monitor, the TRMONDRV program becomes resident in 
memory. The Token-Ring Monitor Selection menu no longer contains the Configure 
Token-Ring Monitor option. Also, the menu now contains the Terminate Token-Ring 
Monitor option, as shown in Figure 13. 


Monitor Selection meni 


Figure 13. The Terminate Token-Ring Monitor option. 


You must remove the TRMONDRYV program from memory if you want to do any of the 
following: 


* Configure the Token-Ring Monitor 


¢ Use other functions of the Sniffer analyzer. 


You might also want to remove TRMONDRYV to make room for other applications when 
you no longer need to monitor the network. 


To remove the TRMONDRYV program from memory, choose Terminate Token-Ring 
Monitor on the Token-Ring Selection menu and press Enter. The message “Removing the 
monitor driver from memory...” appears. Then the Sniffer analyzer’s Main selection menu 
is displayed. 


Getting Started 


If you select an analysis or monitoring function from the Sniffer analyzer’s Main selection 
menu while TRMONDRYV is in memory, the Sniffer analyzer displays the following 
messages: 


“The Token-Ring monitor is about to be terminated.” 
“Continuing will cause its data to be discarded.” 
“Do you wish to continue? [y/n]” 


If you type Y and press Enter, TRMONDRYV is removed from memory, and you can 
proceed to use the Sniffer analyzer’s other network analysis or monitoring programs. If 
you type N and press Enter, the Sniffer analyzer’s Main selection menu is displayed again. 


Note: Removing TRMONDRV from memory terminates the monitoring session and 
erases from memory all statistics that the Token-Ring Monitor has gathered. To save the 
statistics, you can print out or save a report to disk. Refer to “Creating Reports” in Chapter 
7 for further information on report writing. 


Interacting With the Token-Ring Monitor 


This section describes the notations used on the Token-Ring Monitor main menu and how 
you select options and values by using various keys. For particular tasks (for example, 
displaying statistics for a particular station), refer to the chapters that follow. The menu 
conventions are consistent with those of the Sniffer analyzer. 


The Menu Structure 


All Token-Ring Monitor functions are accessible through the main menu (Figure 9). When 
the main menu first appears, the Display command is highlighted. Options associated 
with the Display option are listed in the panel to the right. This organization is consistent 
throughout the Token-Ring Monitor’s menu structure: options associated with any 
highlighted command in the middle of the screen always appear to the right. 
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Figure 14. Main menu. 


Moving Through the Menus 


You can move through the menu structure both vertically and horizontally. A highlight 
shows your current location. Move through the menus by: 


Pressing the cursor keys: 


For example, when Display is highlighted, pressing Cursor Up deselects Display and 
highlights History. 


Pressing the Page Up, Page Down, Home, and End keys: 


For example, if your current selection is Display, pressing Page Up or Home selects the 
first command, Transmit timer; pressing Page Down or End selects the last command, 
Exit. 


Typing the first letter of the command’s name: 


If two or more commands start with the same letter, the Token-Ring Monitor selects 

the one that immediately follows the current command. For example, if the command 
currently highlighted is Display, pressing M selects Manage stations; but if Transmit 

timer is the current selection, pressing M selects Monitor filters. 


Two Types of Commands 


On the main menu, an arrow appears to the right of these commands: Transmit timer, 
Display, and Exit. This indicates that you can press Enter to execute these commands. For 
example, when Display is highlighted, pressing Enter displays one type of statistic. 
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Other commands do not have an arrow next to them. They are for specifying options and 
values. For example, when History is highlighted, pressing Enter does not trigger any 
action. Highlighting History displays the current settings that determine how the Token- 
Ring Monitor accumulates history statistics and allows you to modify these settings. 


Choosing Options and Defining Values 


After selecting a command, you can execute it by pressing Enter immediately. If there are 
options associated with that command, or if the command specifies a value, move to the 
list containing the options or the possible values. 


The Token-Ring Monitor “remembers” the options and values you select even after you 
exit the program or turn off your PC. The next time you start the Token-Ring Monitor, the 
same settings appear on the menu. 


Choosing Among Options 


A list from which you choose an option is identified by a double line to its left. To choose, 
move to the option you want and press the Spacebar. An arrow appears to the left of the 
option, indicating that it is selected. Figure 15 is an example showing that the Alarm log 
option has been selected. 


For the Display command, if you want to execute the command immediately with the 
selected option, you need not use the Spacebar. Simply move to that option and press 
Enter. 


For example, after selecting the Display command, a list appears to its right. It contains 
mutually exclusive options that represent the different types of statistics (for example, 
statistics for the entire network, statistics for a single station, etc.). The arrow on the double 
line indicates which option is selected. Move to the list by pressing Cursor Right; then 
move to Alarm log. After you press Enter, the Token-Ring Monitor displays the alarm log. 
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Figure 15. Selecting Alarm log on the main menu. 


Some commands have options that can be further configured. For example, if you select 
Station history for the Display command, a list appears, which allows you to select 
Numeric or Graphic. Follow the instructions provided earlier in this section to move to and 
select the value. 


Not all options are included in a list. For example, the Class option for the Display 
command appears by itself. Selecting Class displays a list of values (To, From, and Both), 
which determines the type of traffic to be displayed. To select the desired value, move to 
the value and press the Spacebar. 


Choosing Among Values 


For some commands, you can assign values to their associated options. These values are 
displayed after an equal sign. For example, one of the options for the Alarm command is 
displayed as “Auto clear = Off”. It means that the value “0” has been assigned to Auto 
clear. 


To assign a value, move to the option and press Enter. Then one of the following happens: 


* A dialog box appears, prompting you to type a value. 
Type a value within the permissible range and press Enter. 


* A list of values appears. Move to the desired value and press Enter. 


If you do not want to enter or select a value after the dialog box is opened, press Esc to 
close the box and return to the menu. 


Figure 16 is an example showing a station list from which you choose a station. 
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Figure 16. Station list on the main menu. 


Toggling Values 


Some options have values that can be toggled. For example, after highlighting Display, 
you select the All stations option. A list appears in the right panel. Two of the items on the 
list are Active stns only and Inserted stns only, which determine the type of station to be 
included in the display. 


To select an item, move to highlight it and then press the Spacebar. A V mark preceding 
the item means that the item is selected. Pressing the Spacebar again deselects an item. An 
x preceding the item means that the item is not selected. 


If you press Alt and the Spacebar simultaneously, the V and x marks are reversed for all 
the items in the same panel. 


Figure 17 shows the configuration of the All station option for Display. 
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Figure 17. Toggling values on the menu. 


Using the Function Keys 
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When the Token-Ring Monitor displays a menu or statistical display, you can use the 
function keys to manipulate the display or perform various Token-Ring Monitor 
functions. 


From menus, you can use the following function keys: 


* F1 (Help) displays the main Help menu. For further information on the Help menu, 
refer to “Using On-Line Help” later in this chapter. 


* F3 (Display) displays the statistics according to the options associated with Display. 
This key is applicable only after you start a monitoring session. 


* F10 (New monitor/Stop monitor) starts or stops a monitoring session. This key 
toggles between the two functions. 


From views, you can use the following function keys to navigate between menus and 
options. Other function keys might be available, depending on the view being displayed. 
Those keys are described in the chapters corresponding to the views. 


¢ F5 (Menus) returns you to the main menu. 


* F6 (Display options/Return) lets you display and edit options without returning to 
the main menu. This key toggles with “Return,” which returns you to the view. 


In addition to using the function keys, you can press Esc to go back to the previous screen. 


Getting Started 


Using On-Line Help 


The Token-Ring Monitor provides an on-line help facility that displays information about 
the following topics: 


Moving around the menu tree 
Selecting menu options 

Using the function keys 
Testing the transmit wait time 
Testing connectivity 
Monitoring network traffic 
Setting monitor filters 
Specifying history information 
Displaying statistics 
Changing alarm settings 
Using the report writer 


Managing station information. 


To use on-line help: 


1. 


Press F1 (Help) to display the Help menu or relevant submenu. If you press F1 when 
one of the Token-Ring Monitor views is displayed, a description of that view appears. 


In a Help menu, move to the topic for which you want additional information and 
press Enter. 


To scroll through explanatory text, press Cursor Up or Cursor Down. 


Press Esc to return to the Help menu. Press Esc again to return to the screen display 
before you used on-line help. 


Preparing for a Monitoring Session 


Before starting a monitoring session, decide on the following: 


Speed at which the Token-Ring Monitor operates on the network (4 Mb/s or 16 Mb/s) 
Which stations you wish to monitor (all stations or a single address) 


Types of frames to be monitored (Logical Link Control frames, Medium Access 
Control frames, or both) 


Station for which you wish to collect history statistics 


History interval. 


Note: If you choose to monitor only one type of frame or one station, be sure to read 
Chapter 6, “Working with Alarms,” to thoroughly understand how the Token-Ring 
Monitor generates alarms. 
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Specifying Network Speed 


The Token-Ring Monitor can operate ona 4 Mb/s or 16 Mb/s token-ring network. Be sure 
to configure the Token-Ring Monitor so that it passes data to the network at the correct 
speed. 


To set the speed for the Token-Ring Monitor: 
1. Onthe main menu, move to Options. 
2. Press Cursor Right to display the options. 


3. Move to 4 Mb/s or 16 Mb/s, depending on your network. Then press the Spacebar. Be 
sure to select the correct network speed before you start a monitoring session. 


Caution: Connecting the Token-Ring Monitor to a network with a different data rate can 
cause the network to be inoperable. 


If the Token-Ring Monitor runs on a Series 300 or Series 500 Sniffer analyzer, the speed at 
which it operates when monitoring the network can be different from the data rate switch 
setting on the network interface card. However, when it transmits frames to the network, 
the speed specified on the main menu must match the hardware switch setting, or an error 
message appears. The Token-Ring Monitor transmits traffic when you select Transmit 
timer or Station test, which are described in Chapters 8 and 10. 


Specifying Which Stations to Monitor 
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Monitoring all stations gives you the option of displaying statistics for any or all stations. 
If you have not started a monitoring session before, it is recommended that you monitor 
all stations. However, to perform an in-depth analysis for important stations such as 
servers, the Token-Ring Monitor lets you restrict monitoring to one station and to those 
stations that communicate with it. 


To specify which stations to monitor: 


1. You can specify the stations only when the Token-Ring Monitor is not monitoring. 
Make sure that the key label for F10 is “New monitor.” The key label “Stop monitor” 
indicates that a monitoring session is in progress. If this is the case, stop the session by 
pressing F10. 


Move to Monitor filters in the main menu. 


2. To monitor all stations, move to the All stations option and press the Spacebar. 


To monitor a particular station, move to the Stn option and press Enter to display the 
station list, which contains the names of the stations known to the Sniffer analyzer. 
Move to the station to be monitored, and press Enter. The Token-Ring Monitor 
monitors only the specified station and those stations that communicate with it. 


Refer to “The Station List” later in this chapter for further information on how the 
Token-Ring Monitor modifies the list as it monitors the network. 


Getting Started 


After you modify the option for Monitor filters, the new setting takes effect in the next 
monitoring session. 
Specifying the Types of Frames to be Monitored 


You can configure the Token-Ring Monitor to monitor only the MAC frames, the LLC 
frames, or both. The MAC frames contain information on the network status, and are 
generated automatically by network interface cards on the token ring. The LLC frames are 
data frames sent by the host computers on the network. 


To specify the types of frames to be monitored: 


1. Stop the monitor if a monitoring session is in progress. Move to Monitor filters in the 
main menu. 


2. To monitor both MAC and LLC frames, move to All frames. To monitor either type 
of frame, move to LLC frames or MAC frames. Press the Spacebar to choose the 
option. 


The new setting takes effect in the next monitoring session. 


Specifying History Options 


History statistics provide an overview of when the network was busy, at what time of the 
day stations generated errors, and so on. You can configure the Token-Ring Monitor to 
collect history statistics for a specified address. 


Note: Be sure that the station for which the statistics are collected is included in the list of 
stations that the Token-Ring Monitor monitors. Suppose the Token-Ring Monitor 
monitors the traffic to and from ServerA only and you specify that history statistics be 
collected for ServerB. The Token-Ring Monitor displays no history statistics. 


To select the station for which the Token-Ring Monitor will collect history statistics: 

1. Move to History in the main menu. 

2. Move to the Stn option. 

3. Press Enter to display the station list. 

4. Move to the station that you want to collect history statistics for and press Enter. 


5. Ifyou want the Token-Ring Monitor to start collecting history statistics for the selected 
station immediately, press Enter. To cancel the selection, press Esc. 


Specifying History Interval 


The history interval defines the interval at which the Token-Ring Monitor accumulates 
statistics. The Token-Ring Monitor gathers statistics during the time specified and records 
them at the end of the time period. For example, if you define a 5-minute interval, the 
Token-Ring Monitor accumulates the statistics within each 5-minute period and records 
the statistics every five minutes. For the next 5-minute period, it starts accumulating the 
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statistics from 0. (For information about how to display history statistics, see Chapter 4, 
“Displaying Statistics.”) 


You can compile history statistics for up to 30 days, depending on the value of History 
length you specify in the Configuration Options view. 


Note: Designating a different station or changing the interval setting for History erases the 
history statistics, but leaves other statistics intact. 


To specify the history interval: 
1. Move to History in the main menu. 
2. Move to Intrvl and press Enter. A dialog box appears. 


3. Type the number of minutes and seconds in the hh:mm:ss format (between 00:00:05 
and 24:00:00) to define the interval and press Enter. The default value is 15 minutes. 
Press Esc to abort without changing the interval. 


Using the Token-Ring Monitor with the IBM LAN Manager 


If you are running the IBM LAN Manager on the network, set its Trace Option to “All” 
before starting a monitoring session. This setting allows all adapters to trace frames. 
Without this setting, the LAN Manager will remove the Token-Ring Monitor from the 
network. For further information on how to set the option, refer to I]BM’s documentation 
on LAN Manager. (The LAN Manager program described here is IBM’s software for 
managing a local area network, not the LAN Manager developed by Microsoft, which is 
part of an operating system.) 


Starting a Monitoring Session 


The Token-Ring Monitor is ready to monitor the network after you configured it according 
to the instructions in the previous sections. 


To start a monitoring session: 
1. Press F10 (New monitor). The Token-Ring Monitor displays a message similar to this: 


“The Sniffer Network Monitor will enter the ring at 4 MBits/s. Press ENTER to 
proceed. Press Esc to cancel.” 


2. Ifthe speed displayed in the message is correct, press Enter to start the monitoring 
session. Otherwise, press Esc to return to the main menu. Follow the instructions in 
“Specifying Network Speed” to reset Options. 


It takes about 30 seconds for the Token-Ring Monitor to enter the network. After the 
Token-Ring Monitor starts monitoring, the key label on the screen for F10 changes to 
“Stop monitor.” 


To display the statistics during a monitor session, refer to instructions in Chapter 4. 


Note: When the Token-Ring Monitor is monitoring the network or performing a transmit 
timer or station test, if for any reason you need to reboot the PC, you must power off the 
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PC and power it back on. Pressing Ctrl, Delete, and Alt simultaneously to reboot results 
in a parity error. 


The Station List 


Once the Token-Ring Monitor starts a monitoring session, it can detect stations on the 
network and add their addresses or names to the station list. If you want to monitor or 
collect statistics for a particular station, choose the station from this station list. 


If you set Monitor filter to All stations, the Token-Ring Monitor detects any station that 
transmits packets on the network during the monitoring session and adds the station to 
the station list. If the Stn option is selected instead of All stations, and Stn is set to an 
address, the Token-Ring Monitor adds to the station list those stations that have sent 
frames to or received frames from the specified address. 


When you first start up the Token-Ring Monitor, the station list contains the names of the 
stations in STARTUP.TRD in the C:\TRSNIFF directory, a station data file that the Sniffer 
analyzer uses. After monitoring the network for a while, the Token-Ring Monitor adds 
more stations to the list. If a station you want to collect statistics for does not appear on the 
list, check to make sure the station is turned on and sending traffic. If the station’s address 
still does not appear in the station list, this may indicate a connectivity problem between 
the station and the network. 


For further information on STARTUP.TRD, refer to Chapter 5, “Managing the Station Data 
Files.” The Sniffer Network Analyzer Operations Manual also describes the name files. 


Naming Stations 


When the Token-Ring Monitor detects a station on the network that has not been assigned 
a name, the Token-Ring Monitor generates an alarm. (You can, however, disable this 
alarm function. Refer to Chapter 6 for more information on controlling alarms.) This alarm 
alerts you to intruders or to possible problems with network bridges or malfunctioning 
network interface cards. To make the alarms useful, it is recommended that you name all 
the stations. (Because the Token-Ring Monitor and the Sniffer analyzer share the same 
name file, the station names added to C:\TRSNIFF\STARTUP.TRD by the monitor are 
also used by the analyzer.) Refer to Chapter 8 for further information on naming stations. 


When you terminate TRMONDRYV, all unnamed addresses are erased from memory. 


At 
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Stopping a Monitoring Session 


When you stop a monitoring session, the TRMONDRV program stops monitoring, but 
remains in RAM. 


To stop a monitoring session: 
1. Press F10 (Stop monitor). The following message appears: 


“The Sniffer Network Monitor will stop monitoring if you proceed. Press ENTER to 
proceed. Press ESC to cancel.” 


2. Press Enter. The Token-Ring Monitor displays “Leaving the ring.” 


After the Token-Ring Monitor stops the monitoring session, the following things happen: 


The label of F10 on the screen changes to “New monitor.” 


If you display a statistics view, the clock in the upper right corner shows “ENDED,” 
followed by the time at which you pressed F10. 


The statistics gathered during the monitoring session that you just terminated are still 
available for display. They are lost, however, once you start another monitoring 


session. To save the statistics, generate reports according to the instructions in Chapter 
7, “Creating Reports.” 


Getting Started 


Monitoring in the Background 


You can start a monitoring session in the background while running another application, 
provided that application does not use the network card. For example, you cannot run the 
Sniffer network analyzer while running the Token-Ring Monitor in the background. 


However, monitoring in the background has these limitations: 


* You cannot display statistics. 


* When you stop the monitoring session, the Token-Ring Monitor loses the statistics 
collected. 


* You cannot save history statistics and reports to the disk. 
To start a monitoring session in the background: 


1. Start the Token-Ring Monitor and initiate a monitoring session as you normally 
would, following the instructions provided earlier in this chapter. 


2. Move to Exit on the Token-Ring Monitor’s main menu to return to the Sniffer 
analyzer’s Main selection menu. 


3. Move to Return to DOS on the Main selection menu and press Enter. Then a DOS 
prompt appears. 


If you want to bring the Token-Ring Monitor to the foreground (for example, to display 
the collected statistics), type MENU at the DOS prompt to display the Sniffer analyzer’s 
Main selection menu. Then start the Token-Ring Monitor as you normally would. The 
monitor’s menu appears. 


To stop a background monitoring session, you must first bring the Token-Ring Monitor to 
the foreground. When the monitor’s main menu appears, press F10. 
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Chapter 4. Displaying Statistics 


This chapter describes how to display the results of the Token-Ring Monitor's activities. 
You can choose what you see and how you see it. 


The following are examples of what you can display: 


* Traffic statistics for the entire network (global statistics) 

* Traffic statistics for a single station 

* Traffic statistics for every station on the network. 

The Token-Ring Monitor sorts all these statistics according to your specifications. It can 


also display a breakdown of frame sizes and the amount of remote traffic compared to 
local traffic. 


Note: After you start monitoring, pressing F3 (Display) displays whatever statistics you 
selected in the Display submenu. The default setting when you first start the TRMON 
application is Global statistics, which displays the Global Statistics view. 


This chapter describes the general display options and discusses the display for each type 
of statistic. Chapter 10 explains the various types of information in each view. 


Display Options: An Overview 


This section describes only the options that apply to more than one type of statistic. More 
specific options (for example, Route path and Route length, which apply only to Routing 
info) are discussed in the sections that follow. 


In general, you can specify the following options for Display: 


* The type of statistic to display (for example, Global Statistics or Alarm Log). 


Some options allow you to specify how statistics are displayed (that is, numerically or 
graphically). 


* The class of traffic (that is, traffic to or from the station, or both). 


* Network usage (that is, relative or absolute). 


Numeric vs. Graphic Display 


You can configure the Token-Ring Monitor to provide either a numeric or graphic display 
for the following types of statistics: 


* Global statistics 
* Single station 

e All stations 

* Global history 


* Station history. 


The numeric display consists of columns of numbers; the graphic display presents values 
on a graph for a visual overview of network usage. 
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For each graphic view, you can scale the usage axis by pressing F7 or Cursor Up (Scale up), 
or F8 or Cursor Down (Scale down). 


When you scale down, the bars in the graph become shorter. When you scale up, the bars 
become longer to show the greater level of detail. If a bar is longer than the axis, a triangle 
is displayed on top of the bar. 


Class Option: To, From, or Both 


The Class option applies to the following types of statistics: 
* Single station (for the graphic display only) 

* Allstations 

* Station history. 


For each station, the Class option determines whether statistics are displayed for received 
frames (To), transmitted frames (From), or both (Both). 


Network Usage Option: Absolute vs. Relative 


The Network Usage option applies to the following types of statistics: 
* Single station 
* All stations 


* Station history. 
The Network usage option can be set to one of the following: 


Absolute Statistics are measured as a portion of the total network capacity, which 
remains constant. For example, if all stations together use 10% of the total 
capacity, absolute usage is 10%. 


Relative Statistics are measured as a portion of the total traffic. For example, if one 
station accounts for all the traffic on the network, its relative usage is 100%; 
if four stations generate traffic in equal amounts, relative usage for each is 
25%. 


It is possible that a station accounts for a high percentage of relative network usage but a 
low percentage of absolute network usage. For example, if there are only two active 
stations on the network, which generate about the same amount of traffic, their relative 
usage is approximately 50% each. But if these stations rarely generate traffic, their absolute 


network usage can be as low as 1%. In this case, about 99% of the network capacity is 
unused. 


Only absolute network usage is displayed in global statistics views. The Relative option 
does not take effect, for example, when you display global statistics or global history. 


Note: If you choose the Both option for Class, the relative network usage percentages can 
add up to 200% because the Token-Ring Monitor counts each frame twice: once for the 
source address and once for the destination address. 


48 


Displaying Statistics 


Freezing the Screen Display 


When a statistical view is displayed during a monitoring session, pressing F9 (Freeze 
display) stops updates to the screen temporarily to make it easier to study specific 
statistics. The clock in the upper right corner is stopped as well. However, the Token-Ring 
Monitor continues updating and compiling statistics in the background. To redisplay the 
current statistics, press F9 again. 


Scrolling the Screen Display 


If there are more stations than a screen can contain in a view, use F3 (Prev station) or F4 
(Next station) to view the previous or next station. In a numeric view, Cursor Up and 
Cursor Down have the same function as F3 and F4, respectively. 


To look at the first screen of information, press Home; to look at the last screen, press End. 


Displaying Global Statistics 


The Global Statistics view displays traffic statistics for the entire network as they are 
updated, either in numeric or graphic format. 


Figure 18 is an example of the numeric Global Statistics view. The numeric view presents 
three categories of statistics: 


Traffic counts Counts on the left show the amount of cumulative activity since the 
beginning of the monitoring session. Counts on the right show 
activity in the last second. 


Error counts The Error Counts column indicates the overall condition of the 
network, the number of oversized frames, the number of ring 
purges, and the number of soft error report frames. For further 
information on error counts, refer to “Display Global Statistics” in 
Chapter 10. 


To check which stations report most of the soft error frames, select 
the All stations option for Display once you return to the main 
menu. 


Timestamps The timestamps include the time when monitoring started and the 
time when the first and last network activities took place. The 
Token-Ring Monitor also shows the duration of a monitoring 
session. 
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LOBAL STATISTICS Oct 02 17:04: 
Traffic Counts 


| 

| 
Maximum Inserted Stns Current Inserted Stn: | 
Total Stations 


Error Counts 


Operating Normally 
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Figure 18. Global statistics (numeric view). 


Figure 19 is an example of the graphic view of Global Statistics. As in the numeric view, 
the top portion of the graphic view shows traffic counts, both cumulative and for the last 
second. The bottom portion shows absolute network usage plotted as a graph and 
updated at one-second intervals. 
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(GLOBAL STATISTICS———___—_—_—+———{ct 02 17:06: 


Average Usage 
Total Frames 
Total Bytes 

Avg Frame Siz 


6Disply—g/ ScaleG8 Scale—olreezesl0 Stop 
Piems Roxtion§ wf dom fsplayfcnitor 


Figure 19. Global statistics (graphic view). 


To display global statistics: 


Li 


2. 


Move to Display in the main menu. 


Move to Global statistics and press the Spacebar. An arrow appears to the left of the 
option to indicate that it is selected. 


Move to the Numeric or Graphic and press the Spacebar. 


Press F3 (Display) to display the statistics. Statistics are updated until you press F10 
(Stop monitor) or exit the current view. 


Displaying Station Statistics 


The Single Station view displays traffic statistics to and from specific stations as they are 
updated, either in numeric or graphic format. 


In the numeric view, there are three columns: 


The top-left column identifies the station to which these statistics apply, as well as the 
station’s two most recent partners. 


The top-right column shows combined transmission and reception activity. The 
current usage percentage represents the usage in the past second; other statistics are 
cumulative since the beginning of the monitoring session. 


The lower-left portion shows transmission activity, and the lower-right portion shows 
reception activity. These portions show the same types of statistics, except that the 
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lower-left portion includes the number of errors reported by the station. This error 
count is not included in the lower-right portion because soft error reports are not sent 
to individual stations. 


Figure 20 displays traffic to and from a single station. 


Station: Fi 
Status: Mon 


Last sent to: Alex Zwick 
Last rev from: Ken Quinn 


Traffic FROM Station 


Current Usage 
Average Usage 
Total Frames 
Total Errors 
Total Bytes 
Avg Frame Size 


Rg 
SBRRGe 
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foe} 
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Help options; display—monitor 


Figure 20. Traffic statistics for a single station (numeric view). 


Note: The term “transmission” refers to the source address, or the station from which the 
frames were sent. The term “reception” refers to the destination address, or the station to 
which the frames were sent. To illustrate this distinction, display the station statistics for 
the broadcast address. Since the broadcast address is only used as a destination address, 
you only see traffic in the “Traffic TO Station” category. 


In the graphic view, the top portion displays either receptions, transmissions, or both, 
depending on whether you selected To, From, or Both with the Class option. The bottom 
portion shows either absolute or relative network usage plotted as a graph and updated 
at one-second intervals. The bars on the graph also indicate the class of statistics. For 
example, on a color monitor, the yellow portion of the bar represents transmissions, and 
the blue portion represents transmissions. Figure 21 shows a graphic view of statistics for 
a single station. 


Displaying Statistics 


ABSOLUTE TRAFFIC STATISTICS-SINGLE STATION————————ctt. 02 17:31:24 
Traffic TO and FROM Station 


Station: File Seri 21.61 % 
Status: Monitor 6.58 % | 
195, 386 


Last sent to: 
Last rev from: 


Figure 21. Traffic statistics for a single station (graphic view). 
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To display station statistics: 
1. Move to Display in the main menu. 
2. Move to Single station and press the Spacebar. 


3. Move to the Stn field and press Enter to display the station list. Move to the station 
you want to monitor and press Enter again. 


4. Define how statistics are displayed. 


Move to the Numeric or Graphic options and press the Spacebar. 


To display the Class and Network usage options, press Cursor Left to move back 
to Single station and then press Page Down. 


c. Move to Network usage, and then to either Absolute or Relative, depending on 
whether you want to show statistics as a portion of the total network capacity or 
as a portion of the current total traffic. Press the Spacebar to select the option. 


d. If you select the Graphic option, you can also define the Class options. Move to To, 
From, or Both, depending on whether you want to display statistics for receptions, 
transmissions, or both. Press the Spacebar. 


5. Press F3 (Display) to display the statistics. Statistics are updated until you press F10 
(Stop Monitor) or exit the current view. 
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Displaying Sorted Statistics for All Stations 


This view contains statistics for each station. You can customize the display by specifying 
the following on the main menu: 


* How the statistics are sorted 

* Whether the statistics are displayed in ascending or descending order 

* What statistics are displayed in the view 

¢ Whether the display is in numeric or graphic format. 

Figure 22 shows a numeric example of sorted statistics that include the station, the number 


of frames, errors, bytes, average frame size, and the percentage of absolute network usage. 
These statistics are sorted in descending order by the number of bytes. 


ABSOLUTE TRAFFIC STATISTICS 10 AND FROK STATIONS 02 17:42:17 


tatj ac hs oT] 
otatlon rrames xITs Bytes s1ze ~USage 


US 
1 File Server 276, 009 50 73,432, 466 266 6.51 
2 Print Server 191, 191 56 45,520,130 28 4.08 
3 Denise Martin 19, 580 0 18,011,113 919 1.590 
4 Mark Ellison 19, 801 4 15,513,678 783 1.37 
5 Ed Hicks 19, 380 2 15,013,438 774 1.3 
6 Linus Stanwick 19, 206 3 14282561 743 1.26 
7 Steven Anderson 19, 264 15 9 802,593 508 0.87 
8 William Griffith 19 582 8 6,804,908 347 0.80 
| 9 Tom Brown 19 623 0 6,011,52 306 0.53 
| 10 Michael Harley 19, 809 3 4,914,731 248 0.43 
| 11 Miles Russell 19 575 Qg 2,748,389 140 0.24 
| 12 Barbara Lemmon 19, 565 g 2,707,797 138 0.24 
| 13 Bill Goodman 19, 619 0 2,520,836 128 02 
14 Barney Ingram 0,05 «0 27057 110 019 | | 
15 Ken Quinn 19, 201 2 2,220,008 115 0.19 | 
16 Alex Zwick 19, 715 10 1,982,862 100 O47 X 
17 Helene Milici 19, 558 6 1,947,270 9 O17 o | 
18 George Stanley 19, 901 0 179,588 0 Or 
19 Jill Franz 20, 066 2 1,725,080 8 O01 e 
Robert Hayes 19, 695 2 1444699 73 O11 | 


| v0 
pep | ati ra Disp! OFréeze—il0 Stop 
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Figure 22. Traffic statistics for all stations (numeric viet). 


Sorting Statistics 


The Token-Ring Monitor can sort statistics in a variety of ways. This is useful for 
comparing stations or for finding stations that match certain criteria. The following is a list 
of the sort keys, which applies to both numeric and graphic displays: 


Name Name of the station. 
Partner’s name Last station that communicated with the station. 
Ring order Order in which the stations are located on the token-ring network. 
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Frames Total number of frames transmitted or received, or both transmitted 
and received during a monitoring session. 


Errors Total number of soft error report frames. 

Bytes Total number of bytes transmitted, received, or both. 
Average size Average frame size transmitted, received, or both. 
First activity Time when the first frame was sent or received. 

Last activity Time when the most recent frame was sent or received. 


Elapsed activity Time between the first and last activity. 


Types of Statistics Included in the View 


You can configure the Token-Ring Monitor to display statistics pertaining to these 
stations, whether you use the numeric or graphic display: 


* Active stns only—stations that have sent or received frames on the network since the 
monitoring session started. 

* Inserted stns only—stations whose station status is active monitor, standby monitor, 
or snooper. 


If you select the numeric format, you can also select one or all types of statistics to be 
included in the display. The following list contains the statistic types. Most of the items in 
the list are the same as the sort keys. Refer to “Sorting Statistics” for information on those 
statistic types. 


¢ Partner’s name 


* Station status (for further information on station status, refer to the Chapter 10) 


¢ Frames 
e Errors 
* Bytes 


* Average size 

* Network usage 

* First activity 

* Last activity 

¢ Elapsed activity 

Note: If you select more options than can fit on the screen, use Cursor Left or Cursor Right 


to scroll hidden portions of the screen into view. Pressing Control and a cursor key moves 
you to the far right or left of any screen. 


Numeric vs. Graphic Display 


The numeric display can include various types of statistics according to your specification. 
Refer to “Types of Statistics Included in the View” earlier for more information. 


a 
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The graphic display shows the network usage of up to 10 stations at a time. The 
percentages are represented both in graphs and in numbers. To see more than the 10 
stations, use Cursor Right or Cursor Left. 


The graphic display also indicates the class of traffic from which the statistics are derived. 
Specify the value of the Class option (To, From, or Both) on the main menu. 


Figure 23, for example, shows the stations with the highest amount of relative network 
usage for both transmissions and receptions. The statistics below the graph are derived 
from the transmission and reception counts, while the graph shows all three classes (To, 
From, and Both) for each of the listed stations. 


TIVE TRAFFIC STATISTICS TO AND FROM STATIONN-——————ct 02 18:02: 


Danna 


1 File Server 61.15 % 6 Linus Stanwick 12.10 % 
2 Print Server 38.60 % 7 Steven Anderson 8.52 % 
3 Denise Martin 14.95 % 8 William Griffith 5.6% 
4 Mark Ellison 12.95 % 9 Tom Brown 5.07 % 
5 Ed Hicks 12.40 % 10 Michael Harley 4.16 % 
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Help station—statio options™.. up down fidisplay—gmonitor 


Figure 23. Traffic statistics for all stations (graphic view). 


To display and sort selected statistics: 


1. Move to Display in the main menu. 


2. Move to All stations and press the Spacebar. Additional options appear in the right 
panel. 


3. Follow these steps to define the type of traffic and network usage. 


a. Press Cursor Down to move to the Class option. 
b. Move to To, From, or Both. Press the Spacebar to select one of the options. 


c. Move to Network usage, and select either Absolute or Relative by pressing the 
Spacebar. 


4. To specify the format of the display, move back to All stations. Move to the Numeric 
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or Graphic option in the right panel and press the Spacebar. 


5. If you select Numeric, a list appears in the right panel, which allows you to select the 
types of statistics to be included in the view. Move to any options in the list and press 
the Spacebar to select the options. 


6. To specify how the statistics are sorted, move to Sort by. Two lists of options appear 
to its right. 
a. Move to the Ascending or Descending option in the first list and press the Spacebar. 
Move to the sort key displayed in the second list and press the Spacebar. 


For example, if you select Frames, the Token-Ring Monitor sorts all stations by the 
number of frames and displays them from highest to lowest or vice versa, 
depending on whether you chose the Descending or Ascending option. 


Note: To sort by network usage, select the Bytes option. 
7. To specify the types of stations to be included in the view, move to the left panel. 


If you want the view to include only the stations that have sent or received traffic, 
move to Active stns only. If it has not been selected, press the Spacebar. 


If you want the view to include only the inserted stations, move to Inserted stn only. 
If it has not been selected, press the Spacebar. 


8. Press F3 (Display) to display the sorted statistics you specified. If there are too many 
options to fit on the screen in the numeric view, use Cursor Right or Cursor Left to 
scroll them into view. 


9. To display stations either higher or lower in the sort order, press F3 (Prev station) or 
F4 (Next station). 


Displaying Frame Sizes 


This view displays how many frames fall into each of the predefined size categories and 
what percentage of frames each size category comprises. The graph illustrates these 
numbers for a visual overview. This information is useful for determining how to 
configure your network’s data buffers. Figure 24 is an example of the Frame Sizes view on 
a 4-Mb/s network. 
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| Size Frames Percent 0 20 40 60 

Under 17 0 0.00- 

We 0 0.00 + 
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O51 512 47.165 5.87 | 
513- 1024 19, 230 2.30 | 
1025- 2048 45,686 5.69 
2049- 4096 20, 329 2.53 | 
4097- 4608 0 0.00 - 
Over 4608 0.00 - 
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Figure 24, Frame Sizes view. 


To display frame sizes: 
1. Move to Display in the main menu. 
2. Move to Frame sizes and press the Spacebar. 


3. Press F3 (Display) to display the frame size distribution. 


Displaying Routing Information 


The Token-Ring Monitor provides two views that contain routing information. The 
Routing Paths view shows the amount of traffic routed to and from the local ring; the 
Routing Lengths view breaks down the number of routed frames by the length of the 
route. The length is measured by the number of token-ring bridges a frame has traversed. 


Figure 25 and Figure 26 are examples of the Routing Paths view and Routing Lengths view 
at a given time. 
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Figure 25, Routing Paths view. 
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Figure 26. Routing Lengths view. 
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To display routing information: 

1. Move to Display in the main menu. 

2. Move to Routing info and press the Spacebar. 

3. Move to Route path or Route length and press the Spacebar. 


4. Press F3 (Display) to display the routing information. 


Displaying SAP Protocol Types 


60 


This view displays the number and percentage of either bytes or frames for each SAP 
(Service Access Point) protocol type. The view also presents these numbers with bar 
graphs. A Service Access Point is a logical point where protocol layers exchange services. 
For further information on SAP, refer to Token-Ring Network, Architecture Reference. 


Figure 27 is an example of the Protocol Types (SAPs) view that shows the distribution of 
bytes by protocol type. 
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Figure 27. Protocol Types (SAPs) view. 


The protocols shown in Figure 27 are defined in the Token-Ring Monitor's start-up file 
STARTUP.TRT. Any protocols that are not in this file are listed under the category 
“Other.” If you want breakdowns for protocol types other than those shown, you must 
add the protocols to STARTUP.TRT before a monitoring session. (Chapter 9 provides 
more information on STARTUP.TRT.) 


To display the SAP protocol type distribution: 
1. 
2. 
3: 


4, 


Displaying the Alarm Log 


Move to Display in the main menu. 


Displaying Statistics 


Move to SAP protocol types and press the Spacebar. 
Move to the Bytes or Frames option and press the Spacebar. 


Press F3 (Display) to display the Protocol Types (SAPs) view. 


This view displays the alarm log, which shows the alarms in the Token-Ring Monitor's 
alarm buffer. Figure 28 is an example of the Alarm Log view. 
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5 or more error reports 
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Figure 28, Alarm Log view. 


When the Alarm Log view is displayed, you can do the following: 


Use Cursor Up or Cursor Down to highlight any alarm. Then acknowledge the 
highlighted alarm by pressing F3 (Ack alarm), which puts a V mark in the right 


Clear the alarm by pressing F4 (Clear alarm), which deletes it from the alarm buffer. 
(For a complete discussion of alarms and the alarm buffer, see Chapter 7, “Working 
with Alarms.”) 
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To display the alarm log: 
1. Move to Display in the main menu. 
2. Move to Alarm log and press the Spacebar. 


3. Press F3 (Display) or press Enter. 


Displaying Global History Statistics 


This view displays history statistics for the network as a whole. Because history statistics 
include the time network events occurred, they are particularly useful for troubleshooting 
and network maintenance tasks, such as determining periods of low activity to schedule 
downtime. 


Note: History statistics are erased from memory when you start anew monitoring session 
or when you change the history interval during a monitoring session. 


The numeric view (Figure 29) shows the following types of information for each interval: 


* Interval number 

* Timestamp 

* Number of frames, errors, and bytes 
* Average frame size 


* Percentage of absolute network usage. 


LOBAL HISTORY STATISTICS-——————————Octt._ 26 16:36:85 
ime Frames Errs Bytes Size “Usage 
2t Oct 26 16:36:43 17, 468 12 4,533,409 29 7.7 
20 16:34:43 28, 984 3 7,220,903 249 12.38 
19 16:32:43 24,326 6 5,747,665 236 9.86 | 
18 16:30:43 22, 886 15 5,740,709 20 9.83 
17 16:28:43 24,973 3 6,687,986 267 11.43 
16 16:26:43 2, 069 a5 6, 382, 2A 10.92 
15 16:24:43 2, 788 2B 6,407,011 230 10.990 | 
14 16:22:43 2, 063 su 6,571,694 262 11.24 
13 16:20:43 2D, 369 13 6,205,828 244 10.63 
12 16:18:43 24, 168 12 6,140,575 24 10.51 
11 16:16:43 26, 289 10 6,781,064 27 11.60 
10 16:14:43 26, 366 9 6,715,119 24 11.49 
g 16:12:43 26, 969 13 6,152,979 228 10.56 
8 16:10:43 26, 091 7 6,511,200 249 11.15 i 
7 16:08:43 22, 652 3 5,513,472 243 9450 
6 16:06:43 4, 378 6 6,59, 404 20 11.9r 
5 16:04:43 24, 485 9 6,095,834 248 10.44e 
4 16:02:43 22, 415 14 5,471,446 244 9.38, 


ies Morton nite 
Help earlier™ .later loptions monitor) 


Figure 29. Global history statistics (numeric view). 
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The graphic view (Figure 30) shows the following types of information: 


¢ Interval number 
¢ Timestamp 
* Percentage of absolute usage 


* Graphic representation of the percentage of absolute network usage per interval. 


Time sa 


C7 
{ap} 
c 

f 
a 
k 
NO 
oO 
NM 
—- CD 


2L Oct 26 16:36:43 7B 

20 16:34:43 12.38 

19 16:32:43 9.86 

18 16:30:43 9.83 
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15 16:24:43 10.99 

14 16:22:43 44 

13 16:20:43 10.63 

12 16:18:43 10.54 | 
14 16:16:43 11.60 
10 16:14:43 11.49 | 
g 16:12:43 10.56 
8 16:10:43 14.15 | 
7 16:08:43 9.45 ) 
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5 16:04:43 10. 44 e 
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ie _Help lear lie e options -up down moni tor a 


Figure 30. Global history statistics (graphic view). 


To display global history statistics: 

1. Move to Display in the main menu. 

2. Move to Global history and press the Spacebar. 

3. Move to the Numeric or Graphic option and press the Spacebar. 
4. Press F3 (Display) to display the history statistics. 


Press F3 (View earlier) or F4 (View later) to view intervals recorded earlier or later. 
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Displaying Station History Statistics 


The Token-Ring Monitor collects and displays history statistics for the station you 
specified with the Stn option under History in the main menu. 


Although the numeric and graphic Station History views include the same types of 
information as the Global History views, you can customize the Station History views 
further to show whether: 


° History statistics include transmissions, receptions, or both 


* Network usage shown is absolute or relative. 


Note: You can collect station history statistics for only one station at a time. Also, history 
statistics are erased when you start a new monitoring session or if you change the history 
interval during a monitoring session. If you need to save them, generate a report. (See 
Chapter 7, “Creating Reports.”) 


Figure 31 shows the history for the station “File Server,” which shows transmissions and 
receptions compared to relative network usage. Figure 32 graphically illustrates relative 
network usage for that station. 


| ABSOLUTE HISTORY STATISTICS TO AND FROM File Servep————Oct 26 16:39: 


Time Frames Errs Bytes Size %Usage | 
2 Oct 26 16:38:43 3,805 0 931,303 243 1.59 | 
mn 16:36:43 10,513 3 2962100 281 5.06 | 
0 16:34:43 16, 919 3 4 437,814 262 7.59 | 
| 19 16:32:43 14, 263 2 3,201,840 224 5.50 | 
| 18 16:30:43 13, 286 4 3,452,364 259 5.9 | 
| 17 16:28:43 14, 555 0 4179546 287 7.13 | 
| 16 16:26:43 14,674 1 3,930,000 268 6.73 | 
45 16:24:43 15, 689 5 3,772,781 240 6.47 
14 16:22:43 14,504 7 3,987,243 273 681 
13 16:20:43 14, 588 0 3,778,333 20 6.46 
19 16:18:43 14, 230 3 3814111 268 6.52 | 
14 16:16:43 15, 302 4 4 305,063 28 7.50 
| 10 16:14:43 45, 524 0 4.036,815 260 6.90 | 
| y 16:12:43 15,719 4 3,773,153 240 647K | 
8 16:10:43 15, 254 3 3,941,120 28 6.740 
7 16:08:43 13,172 Z 3,470,480 263 5@Br | 
6 16:06:43 15, 284 6 4070.68 266 6%e 
| 5 16:04:43 14,305 4 3,710.70 29 634, | 
—— | | 


Views b oDisply 0 Stop 
| Help ear lier} e options; monitor 


Figure 31. Station statistics for "File Server" (numeric view). 
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Figure 32. Station statistics for "File Server" (graphic view). 


To display the station history: 


1, 


2. 


Move to Display in the main menu. 


Move to Station history and press the Spacebar. 


Define how statistics are displayed. 


a. 
b. 


d. 


Press Cursor Down to display the Class and Network usage options. 


Move to Class, and then to To, From, or Both, depending on whether you want to 


display statistics for receptions, transmissions, or both. Press the Spacebar. 


Move to Network usage, and then to either Absolute or Relative, depending on 


whether you want to show statistics as a portion of the total network capacity or 


as a portion of the current total traffic. Press the Spacebar. 


Move to the Numeric or Graphic option and press the Spacebar. 


4. Press F3 (Display) to display the history for a selected station. 


Press F3 (View earlier) or F4 (View later) to view intervals recorded earlier or later. 
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Managing the Station Data Files 


Chapter 5. Managing the Station Data Files 


The Token-Ring Monitor station data files in the C:\TRSNIFF directory contain station- 
specific information. The STARTUP.TRD file contains station addresses and names; the 
STARTUP.TRA file contains the alarm thresholds for each station. (Refer to Chapter 6, 
“Working with Alarms,” for further information on alarms.) As the Token-Ring Monitor 
monitors the network, it automatically builds these files by adding addresses that have 
been named. The Token-Ring Monitor also assigns the default station alarm settings to 
these stations. 


The Sniffer analyzer and the Token-Ring Monitor use the same name file. Either the 
monitor or analyzer can modify the STARTUP.TRD, and the change affects the operation 
of both. For further information on how the Sniffer analyzer uses or changes the name file, 
refer to the Sniffer Network Analyzer Operations Manual. 


Note: You can also add stations manually by editing the fileSTARTUP.TRD with an ASCII 
text editor. This lets you add stations that are not yet active on the network. 


This chapter describes how you customize the settings associated with each station in the 
data file. The description includes: 

* Identifying stations 

* Assigning names 

* Assigning station alarm thresholds 

* Deleting stations 

* Returning to an earlier version of the data file. 

By choosing Manage stations from the main menu and Edit from the submenu, you can 
view and edit the data file via the Manage Station Information view (Figure 33). Any 


changes you make are automatically saved when you exit this view. You can also display 
the Manage Station Information view by choosing Edit under Alarm on the main menu. 


The Token-Ring Monitor automatically creates a backup copy of the data file the first time 
you modify it after invoking the TRMON program. The backup data files are named 
BACKUP.TRD and BACKUP.TRA. 
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AGE STATION INFORMATION 
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oO 
2) 
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Figure 33. Manage Station Information view. 


Identifying Stations 


The Token-Ring Monitor identifies stations by examining the hexadecimal 12-character 
strings that form the stations’ addresses. You should assign names to these addresses for 
several reasons: 


* Names are easier to identify in a view than addresses. 
* You cannot save changes to station alarm thresholds for unnamed stations. 


* Unnamed stations are deleted from the station list if you unload the TRMONDRV 
program. 


* Unnamed stations trigger alarms. If you do not assign names to the stations, you 
would be unable to tell whether an alarm is caused by an unnamed station, an 
intruder, or a network problem. 


Before you can name stations, you must determine which address belongs to which 
station. The USERLIST report helps you list all the stations on the network. 


To run the USERLIST report: 

1. Monitor activity for several hours. 

2. Move to Report in the main menu. Then select the Load option. 

3. A window containing a list of reports appears. Move to USERLIST.SCR and press 


Enter. The Token-Ring Monitor displays “Loading report script” and returns to the 
main menu. 
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———— 


Select the Print option for Report. A list of device names appears in the right panel. 


To view the station addresses on screen, select Screen in the list of devices. 
Alternatively, you can send the report to a printer by selecting a printer port in the list 
or save the report to disk. “Creating Reports” in Chapter 7 discusses how to print and 
save reports. 


Press Cursor Left to move back to Print. Press Enter to print the station list, which 
contains all addresses detected by the Token-Ring Monitor. Write down each station’s 
name next to the address and use this list to add station names to the data file, as 
described in the next section. 


Editing Station Information 


Editing station information involves assigning names and alarm thresholds. After you 
assign station names, these names identify the stations in the Token-Ring Monitor views. 


Naming Stations Automatically 


If you installed a second network interface card that runs a NetBIOS stack in the Token- 
Ring Monitor station, and if the stations you want to name are active and are running the 
same NetBIOS stack, you can name them automatically. This feature saves you 
considerable time. 


The procedure in this section assumes that the NetBIOS stack has been loaded on the 
second network interface card. 


To name stations automatically with NetBIOS: 


1, 


2. 


Move to Manage stations in the main menu. 
Move to Probe for names in the submenu and press Enter. 


NetBIOS transmits a query to each unnamed address in the station list. If it receives a 
response, the Token-Ring Monitor assigns a name to the station. To interrupt this 
process, press Esc. 


Follow the procedure in the next section to name any stations that could not be named 
automatically. 


Note: If you are using the LattisNet™ network management software, you can also use 
that product's files to name your stations. See Appendix B, “Command Line Options.” 


Naming Stations Manually 


Station names can be up to 16 characters long; all printable characters are allowed. 


To name a station: 


aie 


Move to Manage Stations in the main menu. 


2. Move to Edit in the submenu and press Enter to display the Manage Station 


Information view. 


ng — ———_ ——— ——— 
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3. Move to the station you want to name and press Enter. A dialog box appears with a 
list of the fields you can edit, as shown in the example in Figure 34. 


AGE STATION INFORMATION 


Address Name sp Idle } 
00 5... OFF 2 _ Warning 
00 5 ] 2 Warning 
0000004 5 25 Warning 
0000004 5 25 Warning 
000004 Be OEE 2 Warning 
0000004! 5 tT Warn ng 
Q000004K2001 D 2 Warning 
0000004 F100 E < 2 rning 
O000004K4302 F < 2 Warning 
0000004E2504 F < 2 Warning 
00000040005 & < 25 Warning 
O000004E0062 H % 4 2 ing 
00000047506 J < ; ing 
O000004E3249 J n press Varning 
0000004E2301 J S Of Warning 
Q000004E0654 5 OH 2 Warning MO 
0000004E001 5 Off 5 Warning o | 
| ei 3 BR OFF 5 Warning r 
| 4 5 Warning e 
5 OF 2 Warning y 
press EXTER! 


Figure 34. Dialog box for editing station information. 


4. Move to the Name field and press Enter. Another dialog box appears. 

5. Type the station name in the dialog box and press Enter. 

6. To return to the Manage Station Information view, press F6 (Return); to change other 
values in the dialog box, go to the next section, “Changing Station Alarm Thresholds 


in the Manage Station Information View.” 


The name is saved automatically when you exit the Manage Station Information view. 
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Changing Station Alarm Thresholds in the Manage Station Information View 


In the Manage Station Information view, you can display a dialog box for editing station 


alarm thresholds as shown in Figure 34. For further information on alarms, refer to 


Chapter 6, “Working with Alarms.” Be sure to follow the guidelines in Chapter 6 when 
changing alarm thresholds. 


To change the station alarm thresholds: 


A 


2. 


Move to Manage stations in the main menu. 


Move to Edit and press Enter. The Manage Station Information view appears. 


Move to the station whose settings you want to change and press Enter. A dialog box 


appears with a list of fields you can edit. 


Move to the desired field and press Enter to display an additional dialog box. Select 
or enter a value and press Enter. For example, in Figure 35, a list showing the possible 


Errors threshold settings is displayed. 


Repeat this step for each threshold setting for the selected station. 


AGE STATION INFORMATION: 
Address lame 
00000040303 ES eo 


00000048340 


“sage Priority 


LUL6 ai8iw} 


2 Warning 


4S 
2+ 
ip 


oo000e4k: 5 25 
000000457256 5 2 
00000045290 5 2 
0000004E2001 Denise Martin 5 we 
| O000004E2100 E 2B 
| a 004E 25 
is 
| 25 Warni 
25 Varning 
4 4 2 Warning 
| 0000004h3249 : 2 Warning 
| 000000422301 25 Warning 
| 0000004K0654 an 2 Warni 
00000040012 Lin 5 20 Warnin 
| St 25 
| +0] Es, } 
BG 25 Warning 
| Use T and | then press ENTER--————————— 


Figure 35. Errors threshold settings for station alarms. 


Press Esc to return to the Manage Station Information view. 


Repeat steps 3, 4, and 5 for all the stations you want to edit. 
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Caution: Changing alarm thresholds during a monitoring session can lead to unexpected 
results. For example, if you change a threshold that has already triggered an alarm, no new 
alarm is triggered when the new threshold is reached. Therefore, it is best to make any 
changes before you start monitoring. 


Global Alarm Thresholds and Default Station Alarm Thresholds 


When the Manage Station Information view is displayed, you can change other alarm 
thresholds in addition to the ones described in the previous section. For example, you can 
press F6 to reset the station alarm thresholds to the default settings, or F7 to change the 
global alarm thresholds and station default thresholds. You can also change these settings 
with Alarms on the Token-Ring Monitor’s main menu. Chapter 6, “Working with 
Alarms,” explains what these thresholds mean and how to change them. 


Deleting Stations 


You can delete stations from the Manage Station Information view. The changes are made 
to STARTUP.TRD and STARTUP.TRA as soon as you exit the Manage Station Information 
view. 


Note: To avoid unpredictable results, stop the monitor before deleting a station. If a 
monitoring session is in progress and the Manage Station Information view is displayed, 
press F5 to go to the main menu. Then press F10 to stop the monitor. (F10 is labeled New 
monitor on the screen when the monitor is off.) 


If the Token-Ring Monitor detects the station that you have deleted, it generates an 
unknown station alarm. 


To delete a station: 
1. Move to Manage stations in the main menu. 
2. Move to Edit and press Enter. The Manage Station Information view appears. 


3. Move to the station you want to delete and press F4 (Delete station). 


Returning to the Previous Station Data Files 
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Whenever you change the station data files in the Manage Stations Information view, the 
STARTUP.TRA and STARTUP.TRD files change as soon as you exit the view. The first 
time you modify these files after starting the Token-Ring Monitor in the foreground, the 
Token-Ring Monitor creates backup copies of these files so that you can always return to 
the previous station data files. 


To return to the previous station data files: 
1. Move to Exit in the main menu and press Enter. The DOS prompt appears. 


2. Change directory to the one that contains the Token-Ring Monitor software, if 
necessary. 


3. Type COPY BACKUP.TRA STARTUP.TRA at the DOS prompt and then press Enter. 


Managing the Station Data Files 


4. Type COPY BACKUP.TRD STARTUP.TRD at the DOS prompt and then press 
Enter. 


The next time you start the Token-Ring Monitor, it uses the settings that were in the station 
data files before they were changed. 
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Chapter 6. Working with Alarms 


This chapter explains how alarms work and describes how to use them. It includes 
instructions for the following tasks: 


* Changing alarm thresholds 

* Displaying the alarm log 

* Acknowledging and clearing alarms 
* Printing alarms 

* Saving alarms to disk 


* Setting audible indicator thresholds. 


Figure 36 shows how the Token-Ring Monitor processes alarms. 


Thresholds Alarm | 
Selection 


\ pe a 
wT 


‘Alarm Log View 


Statistics | 


ALARM.LOG 


Figure 36. Alarm processing. 


Overview of Alarms 


When a measured network parameter (for example, the amount of idle time or the number 
of error frames) exceeds the predefined thresholds, the Token-Ring Monitor triggers an 
alarm and sends it to the alarm buffer. You can display the alarms in the buffer, save them 
to the disk, or print them on a printer. 


The Token-Ring Monitor is shipped with threshold settings for the entire network and for 
individual stations. You can change both the global and station threshold settings. For 
station thresholds, you can change the settings for the stations that are already on the 
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network as well as the default settings that will be assigned to new stations when they are 
detected. 


“Global Alarm Thresholds” and “Station Alarm Thresholds” later in this chapter describe 
each type of alarm. The Token-Ring Monitor generates other alarms that you cannot set 
thresholds for. These alarms are generated when the Token-Ring Monitor detects any of 
the following on the token ring: 


* A frame that exceeds 4,608 bytes on a 4 Mb/s network or 18,432 bytes on a 16 Mb/s 
network 


* A Beacon frame, which is sent after a station detected a hard error that renders the 
network inoperable 


* A Ring Poll Failure frame, which is sent by the active monitor after an error occurs 
during a ring poll process. 


Global Alarm Threshold Options 


Alarms are generated when global counts exceed predefined thresholds. For some global 
alarms (Errors, Usage, and Broadcast), you can determine the interval to which the 
threshold applies. For example, if you set the errors threshold at 10 and the interval at 60 
seconds, the Token-Ring Monitor triggers an alarm if it detects more than 10 soft error 
frames within each 60-second period. 


You can determine global alarm thresholds for these parameters: 


Unknown station — Determines whether or not the Token-Ring Monitor generates an 
alarm when it detects an address that is not in the station list. By 
default, the Token-Ring Monitor generates an alarm when it detects 
an unknown station. 


Errors Defines the number (1 to 65,535) of soft error report frames that 
triggers an alarm. To turn the alarm off, choose 0. You can set the 
interval to which this threshold applies (5 seconds to 60 minutes). By 
default, the number of errors is 5; the interval is 30 seconds. 


Usage Defines the percentage (1 to 100%) of absolute network usage that 
triggers an alarm. You can set the interval to which this threshold 
applies (5 seconds to 60 minutes). By default, the percentage is 25; 
the interval is 5 seconds. 


Broadcast Defines the number of broadcast frames (1 to 65,535) that triggers an 
alarm. To turn the alarm off, choose 0. You can set the interval to 
which this threshold applies (5 seconds to 60 minutes). By default, 
the number of broadcast frames is 100; the interval is 5 seconds. 


Idle Defines the length of time (1 to 120 minutes) the network can be 
inactive before generating an alarm. To turn the alarm off, choose 0. 
By default, the length of time is 15 minutes. 


All global alarms have the priority level “Critical.” If Audible alarms on the main menu 
is enabled, a critical alarm generates an audible indicator. Refer to “ Audible Indicators” 
later in this chapter for further information on priority levels and audible alarms. 
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Station Alarm Threshold Options 
For each station, you can determine the alarm thresholds for these parameters: 


Errors Defines the number of soft error reports (1 to 65,535) a station can transmit 
before triggering an alarm. The default is 5. 


Noresponse Defines how long a station can receive frames without responding before 
triggering an alarm. To turn the alarm off, choose 0. The default is 5 
seconds. The possible value can range from 1 to 7 seconds. For further 
information on when the Token-Ring Monitor generates a no-response 
alarm, refer to “Alarm” in Chapter 10. 


Idle Defines the length of time (1 to 120 minutes) a station can be inactive (not 
transmitting) before triggering an alarm. To turn the alarm off, choose 0. 
The default is 0. 

Usage Defines the percentage of relative network traffic (1 to 100%) the station can 


transmit before triggering an alarm. The default is 25%. 


In addition to setting up alarm thresholds, you can determine the importance of the alarms 
for each station. The priority values are Inform, Warning, Minor, Major, and Critical. The 
default priority value is Warning. The priority value assigned to a station determines 
whether the Token-Ring Monitor generates an audible signal if that station generates an 
alarm. For further information on audible alarms and priority settings, refer to “Audible 
Indicators” later in this chapter. 


Interpreting Alarms When Using Monitor Filters 


When you are interpreting alarms, remember that the setting of the Monitor filters option 
affects alarm generation in the following ways: 


* If Monitor filters is set to MAC frames or All frames, the Token-Ring Monitor does 
not generate an idle alarm for a host computer on the network that fails to transmit 
LLC frames. The Token-Ring Monitor generates the alarm only when the adapter in 
that station fails to transmit MAC frames or any frame at all within the time specified 
by the idle alarm threshold. 


* If Monitor filters is set to one station, the Token-Ring Monitor monitors only the 
frames that contain this station’s address. As a result, the Token-Ring Monitor 
considers only the stations that communicate with this address active. It generates idle 
alarms for any stations that are not communicating with the monitored station, 
regardless of whether they have been transmitting frames on the network. 


Strategies for Setting Alarm Thresholds 


This section provides some basic strategies for setting thresholds. However, finding the 
thresholds that best suit your particular network and preferences requires adjustments as 
you go along and as your network grows. 


Caution: Changing alarm thresholds during a monitoring session can lead to unexpected 
results. For example, if you change a threshold that has already triggered an alarm, no new 
alarm is triggered when the new threshold is reached. Therefore, it is best to make any 
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changes before you start monitoring. You can also stop monitoring, make changes, and 
restart monitoring. 


Strategies for Setting Global Alarm Thresholds 


To get started, follow these steps: 


ie 


2. 


Move to the History option in the main menu. 


Select the broadcast address as the station for which the Token-Ring Monitor collects 
history statistics. 


Set the Intrvl option to 15 minutes. 


Monitor traffic over a period of time, such as an 8-hour business day. This gives you 
an overview of your network’s traffic patterns. 


The following is a list of suggestions for setting various global thresholds and handling 
alarms: 


Usage and errors thresholds 


Display the Global History view and note the highest number of errors and usage 
percentage. Then set each threshold for these categories to about 50% higher than the 
highest recorded number. 


Broadcast threshold 

Display the Station History view and note the highest number of frames sent to the 
Broadcast station. Then set the threshold to about 50% higher. 

Idle threshold 

Take into consideration the way your network software operates. For example, if your 


software package automatically transmits traffic every five minutes, setting the idle 
threshold to six minutes alerts you to any problems within a minute. 


Unknown station alarms 


To avoid triggering the unknown station alarm for legitimate stations, be sure to name 
all known stations. This alarm then alerts you to any intruders or new stations. Since 
faulty bridges or bad network interface cards usually generate numerous unknown 
station alarms, this is also a good way to detect problems with bridges and cards. 


Be prepared to adjust the thresholds to higher values if you get too many alarms. If the 
alarms that are generated do not alert you to potential problems quickly enough, adjust 
the thresholds to lower values. 


To change the global alarm thresholds: 


Ls 


Move to Alarm in the main menu. 


2. Move to Threshold and then the Global option. A list of global threshold settings 


appears as shown in Figure 37. 
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Figure 37. Threshold options for global alarms. 


If you do not want the Token-Ring Monitor to trigger an alarm when detecting an 
unnamed station, move to Unknown station in the right panel and press the Spacebar. 
An x preceding this option indicates that the alarm is disabled; a V indicates that an 
alarm is generated for each unknown station. Pressing the Spacebar toggles the value 
of this option. By default, the alarm is enabled. 


Move to the field you want to change and press Enter to display a dialog box or a list 
of values. Type a value or move to a value to select it, and press Enter again. 


Strategies for Setting Station Alarm Thresholds 


When setting alarm thresholds for individual stations, pay particular attention to devices 
that handle a lot of traffic, such as file servers and communications gateways. Since these 
devices are so important to the entire network, it is important to adjust their thresholds so 
that you are alerted to potential problems quickly, without generating unnecessary 
alarms. 


The following is a list of suggestions for setting various station alarm thresholds: 


Errors threshold 


Divide the global errors threshold by the number of stations. Use the resulting number 
as the errors threshold for individual stations. 


Idle threshold 


For devices such as file servers, set the idle threshold as low as 1 minute to alert you 
quickly to potential problems. For stations that are likely to be turned on and off 
periodically, set the idle threshold to OLE? 
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Usage threshold 


To identify any stations that use large portions of the network’s resources, set a low 
usage threshold for individual stations. Use this information to redistribute heavy 
users onto different network segments to prevent degradation of service to other 
users. 


As with the global alarm thresholds, be prepared to make adjustments. 


To change the station alarm thresholds: 


1. 


2. 
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Move to Alarms in the main menu. 
Move to Edit and press Enter. The Manage Station Information view appears. 


Move to the station whose settings you want to change and press Enter. A dialog box 
appears with a list of fields you can edit. 


Move to the desired field and press Enter to display an additional dialog box. Select or 
enter a value and press Enter. For example, in Figure 38, a list showing the possible 
errors threshold settings is displayed. 
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000000484523 B ORE Warning o | 
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5. OFF 2 Warning e 
5 “OEP 2 Warning 4 


Figure 38. Errors threshold settings for station alarms. 


Press Esc to return to the Manage Station Information view. 


Working with Alarms 


Changing the Default Station Alarm Thresholds 


When the Token-Ring Monitor detects new stations on the network, it assigns the default 
alarm thresholds to the stations as it adds them to the station list. If you change these 
default settings, any stations added to the network are assigned the new defaults. If you 
have assigned names to these stations, the threshold information, together with the station 
addresses, is saved in STARTUP.TRA. 


To change the station default alarm thresholds: 
1. Move to Alarms in the main menu. 


2. Move to Thresholds and then Station defaults. A list of default threshold settings 
appears as shown in Figure 39. 


Clonal] 
gi00al 


Station defaults 


if 10 Ne 
| Help monitor 


Figure 39. Station default alarm thresholds. 


3. Move to the field you want to change in the right panel and press Enter to display a 
dialog box or a list of values. Type in a value or move to a value to select it, and press 
Enter. 
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Resetting Station Alarm Thresholds to Default Values 
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If you changed the station alarm thresholds for a monitoring session, you can easily 
restore the default thresholds, either for a single station or for all stations. 


Note: Stop monitoring before resetting alarm thresholds. 

To reset the alarm thresholds to defaults for a single station: 

1. Move to Alarms in the main menu. 

2. Move to Edit and press Enter. The Manage Station Information view appears. 


3. Move to the station you want to reset and press F2 (Apply default). The threshold 
settings for that station change to the default values. 


The Token-Ring Monitor resets the alarm thresholds for that station to the defaults. 

To reset the alarm thresholds to defaults for all stations: 

1. Move to Alarms in the main menu. 

2. Move to Reset thresholds and press Enter. The Token-Ring Monitor displays the 
message, “Any changes made to station alarm configurations will be lost if you 


proceed. Press ENTER to proceed. Press ESC to cancel.” 


3. Press Enter. The Token-Ring Monitor displays the message, “Resetting alarm 
thresholds.” 


Working with Alarms 


Displaying the Alarm Log 


The Alarm Log view displays the contents of the alarm buffer. It lists alarms in the order 
they occurred and shows their priority, the time they occurred, the source of the alarm, 
and the type of alarm. 


Once the Alarm Log view is displayed, you can acknowledge alarms or clear them from 
the alarm buffer. 


To display the Alarm Log view: 
1. Move to Display in the main menu. 
2. Move to Alarm log and press the Spacebar. 


3. Press F3 (Display) or press Enter to display the Alarm Log view. 


Acknowledging Alarms 


To keep track of which alarms have been investigated, mark (acknowledge) those alarms 
in the Alarm Log view. This is particularly useful when more than one person is attending 
to the network. 


When you acknowledge an alarm, the Token-Ring Monitor turns off the audible indicator 
generated by that alarm. Be sure to acknowledge the alarm that you have investigated. 
Otherwise, the Token-Ring Monitor continues to generate the audible indicator caused by 
the investigated network problem, and you can no longer be alerted to new alarms as they 
occur. 


To acknowledge an alarm: 

1. Move to Display in the main menu. 

2. Move to Alarm log and press the Spacebar. 

3. Press F3 (Display) or press Enter to display the Alarm Log view. 

4. Move to the alarm you want to acknowledge and press F3 (Ack alarm). 


A V mark appears in the right column to indicate that you have acknowledged the 
alarm. 


Clearing Alarms 
You should clear the alarms periodically for these reasons: 


* The Token-Ring Monitor’s alarm buffer can contain up to 200 alarms. When the buffer 
is full, new alarms are deferred until you clear some of the existing alarms in the 
buffer. However, a deferred alarm is lost when the condition that caused it no longer 
exists. In this case, there is no record that the deferred alarm occurred, because alarms 
are printed or saved to disk only as they are sent to the alarm buffer. 


* Clearing an alarm ensures that a new alarm is generated if counts for an event again 
exceed the alarm threshold. 
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An alarm is triggered only the first time a measured parameter exceeds the threshold. 
Additional instances of this event are ignored, unless the alarm has been cleared from 
the buffer and the condition that caused the alarm has been removed. For example, a 
station alarm is generated because a station has been idle for 15 minutes. If it continues 
to be idle after you clear the alarm, no new alarms are generated. However, if the 
station transmits at least once and then becomes inactive again for more than 15 
minutes, the Token-Ring Monitor will generate a new alarm for this station. 


The unknown station alarm is the exception. Even if the alarm is cleared from the 
buffer, the same unknown station does not trigger another alarm within the same 
monitoring session. 


Clear alarms only when the Token-Ring Monitor is running in the foreground. You can 
clear alarms in one of two ways: 


Manually clear alarms one at a time. Clear the alarms as soon as you deal with them. 


Specify that the Token-Ring Monitor automatically clear each alarm after it is in the 
buffer for a specified period of time. This method is particularly useful if the Token- 
Ring Monitor is left unattended over long periods of time. Clearing alarms 
automatically helps prevent the alarm buffer from reaching the 200-alarm limit. 


When using the Auto clear feature to clear alarms automatically, also enable the Log to 
option, which automatically prints or saves to disk a record of alarms generated while 
the network is unattended. The logging function is described later in this chapter. 


To clear individual alarms manually: 


L, 


a 


Move to Display in the main menu. 
Move to Alarm log and press the Spacebar. 
Press F3 (Display) or press Enter to display the alarm log. 


Move to the alarm you want to clear and press F4 (Clear alarm). The alarm is cleared 
from the alarm buffer. 


To clear alarms automatically: 


i, 


2. 


3 


Move to Alarm in the main menu. 
Move to Auto clear = and press Enter. 


In the dialog box, type a value between 1 minute and 99 hours and press Enter. 


Working with Alarms 


Using the Token-Ring Monitor’s Logging Function 


The Token-Ring Monitor's logging function automatically prints and saves alarms as they 
are sent to the alarm buffer. This assures that there is a record of alarms, even after they 
are cleared from the buffer and the Alarm Log view. However, the recommended 
procedure is to handle alarms as they happen. 


Printing Alarms 


You can save the alarms for each monitoring session to disk and print them as necessary. 
Alternatively, you can print each alarm on a designated printer as it occurs. 


To print alarms automatically: 
1. Move to Alarm in the main menu. 


2. Move to Log to and make sure a V mark appears to the left of the Printer option. If 
necessary, press the Spacebar to display the V mark. 


3. In the list of printers displayed to the right of the Printer option, move to the 
designated printer and press the Spacebar. 


4. Tospecify the number of lines per page, move to Page size = and press Enter. A dialog 
box appears. 


5. Type the number of lines to be printed before a page break and press Enter. The 
number can range from 1 to 256. The default is 58. 


If the number you specify is greater than the number of lines that fit on a page, the 
printing overlaps the page breaks, which might make the hard copy difficult to read. 


Saving Alarms to Disk 


In addition to—or instead of—printing alarms as they occur, you can save them to the file 
ALARM.LOG in the C:\CAPTURE\TRREPT directory. You can either append the alarms 
to those saved during previous sessions or reinitialize the file each time the Token-Ring 
Monitor starts monitoring. 


It is recommended that you save only the alarms from the current session and deal with 
alarms as they happen. Use the append option only for collecting historical information 
about alarms. Otherwise, the ALARM.LOG file eventually becomes huge. 


To save alarms automatically: 
1. Move to Alarm in the main menu. 
2. Move to Log to and then to File. 


3. Ifnecessary, press the Spacebar to make sure a V mark appears to the left of the File 
option. 


4. Move to Clear alarm file in the right panel. To append the current alarms to existing 
alarms from previous monitoring sessions, press the Spacebar to display the x mark 
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to the left of the option. To overwrite previous alarms, press the Spacebar to display 
aV mark. 


The Token-Ring Monitor saves the current alarms in a file called ALARM.LOG. 


To view ALARM.LOG, return to DOS and display the ALARM.LOG file with an ASCII 
text editor. 


Note: The ALARM.LOG file is not updated while you are viewing it in DOS (or at any 
other time the the Token-Ring Monitor is not running in the foreground). 


Audible Indicators 
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The Token-Ring Monitor generates audible warning signals to alert you to the alarms as 
they occur. By default, any alarm that has a priority level of “Warning” or higher triggers 
an audible signal. Refer to “Station Alarm Threshold Options” in Chapter 5 for 
information on priorities of alarms. 


You can specify the lowest priority level that generates an audible signal. For example, 
you can set the Token-Ring Monitor to generate an audible signal only when a critical 
alarm occurs. 


The audible alarm is in the form of a series of beeps. The number of beeps depends on the 
priority level of the alarm that caused it. For example, an audible alarm caused by an 
inform alarm consists of one beep; an audible alarm caused by a critical alarm is a series 
of five beeps. 


Note: All global alarms have the priority level “Critical.” For example, if the global errors 
threshold is 20, the Token-Ring Monitor generates a critical alarm as soon as the global 
error counts exceed 20. This alarm triggers an audible indicator in the form of a series of 5 
beeps. 


The audible alarm continues as long as the alarm remains unacknowledged in the Alarm 
Log view. After you clear or acknowledge the alarm that caused the audible indicator, the 
beeping stops. 


When the monitor is active, the Token-Ring Monitor continues to generate alarms and the 
associated audible signals even if you run the Token-Ring Monitor in the background. To 
turn off the beeping or to reset the thresholds, bring the Token-Ring Monitor to the 
foreground and follow the instructions below. 


To set the audible alarms: 
1. Move to Options in the main menu. 
2. Move to Audible alarms. 


3. To disable the indicators, press the Spacebar to display the x mark next to Audible 
alarms. Pressing the Spacebar toggles the setting of Audible alarms. If the V mark is 
displayed, the indicators are enabled. 


4. To modify the lowest alarm priority level that triggers an audible alarm, move to 
Priority, then press Enter. A list of priority settings appears. 


Working with Alarms 


Move to the desired priority level and press Enter. 


The new setting takes effect immediately. For example, suppose the Alarm Log view 
contains only one alarm, whose priority is warning. If the Priority option for Audible 
alarms is Critical, the Token-Ring Monitor generates no audible alarms. But if you 
change the Priority option to Inform or Warning, the Token-Ring Monitor generates 
the audible alarm immediately. 
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Chapter 7. Creating Reports 


In addition to viewing network statistics, you can create customized reports that show 
these statistics in any combination, sorted and arranged according to your preferences. 
You can use these reports to document your network activities, justify the need for 
hardware upgrades, compare network performance over time, and so on. 


This chapter provides an overview of the sample report scripts shipped with the Token- 
Ring Monitor and describes the following tasks: 


* Loading a report script 
¢ Previewing a report 


* Printing or saving a report to disk, in either normal or CSV (comma-separated values) 
file format 


* Creating or editing a report script 


* Generating reports from the DOS command line. 


The Token-Ring Monitor Sample Reports: An Overview 


The Token-Ring Monitor comes with report scripts you can use or modify. A report script 
is a template that defines which statistics are included in the report and how these 
statistics are displayed on the screen or page. When you generate a report from a report 
script, the Token-Ring Monitor supplies the statistics, inserts them into the report script, 
and then prints or saves the report to disk. 


You can use the same report script over and over. The statistics shown and the way the 
information is laid out remains constant, only the statistics change from session to session. 


When you use the Token-Ring Monitor for the first time, the only report scripts you can 
load are the sample report scripts shipped with the product, which are described later in 
this chapter. If none of these report scripts suits your needs, create a new report script or 
edit an existing script. Then save this new report script for future reports. You must name 
and save this newly created script before you can load it. 


These are the script files stored in the directory C:\CAPTURE\TRREPT: 


« ERRORS 

* FRAMSIZE 
* HISTORY 

* LISTENRS 

* RINGORDR 
* ROUTELEN 
* BOUTEPTH 
* SAPS 

* ‘TALKERS 

¢ USERLIST 

* USERS 
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« ‘USERSCSYV. 


ERRORS 


The report based on ERRORS.SCR shows the 10 stations that transmitted the most soft 
error report frames. The stations are sorted in descending order by the number of errors. 
Only the stations that have sent at least 5 soft error report frames are included. 


The report shows the following types of statistics: 

* Time monitoring started 

* Time monitoring stopped 

* Duration of the monitoring session (elapsed time) 


¢ Total number of stations. 


Information displayed for each station includes: 

* Sort position 

* Station’s name 

* Number of frames from the station 

* Number of soft error report frames from the station 
* Number of bytes from the station 

* Average size of the frames from the station 


* Percentage of absolute network usage by the traffic from the station. 


96 
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Creating Reports 


this report. 


— 


Monitoring Started: 
Monitoring Stopped: 
Elapsed Time: 


This report provides statistics for the 10 stations which have 
transmitted the most soft error report frames. Stations must have 
transmitted at least 5 soft error report frames to be included in 


Oct 04 00:52:32 Total Stations: 
Cct 04 09:56:03 


0 day(s) 00:03:31 


26 


| Name Frames Errs 
1 Print Server 8, 38 13 
2 File Server 42, 844. 10 
3 William Griffith 843 6 
Hit Esc to quit, any key to continue 


Figure 40. Errors report. 
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FRAMSIZE 


The report based on FRAMSIZE.SCR shows the frame size distribution. The display 
includes the frame size categories, the number of frames per category, and the percentage 
per category. The report also contains a graph that illustrates the percentages. The report 
contains the same information and has the same format as the display generated when you 
select Frame sizes under Display on the main menu. Figure 41 is an example of a report 
based on the FRAMSIZE script. 


< 
rame Sizes 


Under 17 


| 2049- 4006 
| 4097- 4608 
Over 4608 


Hit Esc to quit, any key to continue 


Figure 41. Frame size report. 
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HISTORY 


The report based on HISTORY.SCR shows absolute network usage during each history 
interval. The number of intervals is specified in the configuration procedure. This report 
includes a graph with a scale of 10% to illustrate the network usage percentages. Figure 42 
is an example of a report based on the HISTORY script. 


Inls report provices tratric flstory inrormation. 


10 Oc! 


FS DO OOH O10) 


Figure 42. History report. 


LISTENRS 


The report based on LISTENRS.SCR shows statistics for the 10 stations that received the 
most traffic during the most recent monitoring session. 


Stations are sorted in descending order by the number of bytes received and filtered by 
sort position to display the 10 stations that received and transmitted the most bytes. 


The report shows the following types of overall information: 
* Time monitoring started 
* Time monitoring stopped 


* Duration of the monitoring session (elapsed time). 
Information shown for each station includes: 


* Sort position 
¢  Station’s name 


¢ Number of frames to the station 
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* Number of bytes to the station 
° Average size of the frames to the station 


* Percentage of relative network usage by the frames to the station. 


Figure 43 is an example of a report based on the LISTENRS script. 


Top 10 Listeners 


| This report provides statistics for the 1C stations which have 
| received the most traffic. The stations are sorted by bytes 


received. 


Monitoring Started: 
| Monitoring Stopped: 
Elapsed Time: 


Bee ele Pee ere ee | 


Name Frames Bytes Size % Rel 
| 1 File Server ot 00,888 35 30,40 | 
| 2 Print Server 181 81,384 449 -35.18 
| 3. Mark Ellison oD 12,049 547 5.19 
| | 4 Tom Brom 22 4,264 193 1.88 
| 5 Ken Quinn 16 4066 23 1.77 
| 6 Miles Russell 26 3714 142 1.6 
| 7 David Brooks 2 S5(8- 455 1289 
| 8 Wes Harding 3 3,264 14 1.45 
QO Ed Hicks ~ om 3166 13 «141 
| Y EO lon 2 Vv, LU SL oor 


| Hit Esc to quit, any key to continue 


Figure 43. Listeners report. 
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RINGORDR 


The report based on RINGORDR.SCR shows the relative usage information for all 
stations. The stations are sorted by the ring order in descending order. The active monitor 
is displayed first, followed by the standby monitors. Other stations are arranged 
according to the station status in this order: snooper, removed, remote, inactive, and 
group. Chapter 10 explains the station status. 


The report shows the following types of statistics for each station: 
* Sort position 
* Station status 


* Percentage of relative network usage by the frames from the station. 


The graph in the report illustrates the percentages. The scale of the graph is 100%. Figure 
44 is an example of a report based on the RINGORDR script. 


User Ring Order 


This report provides relative usage information for all users. The 
users are sorted by ring order. 


Name Status kel 0 20 40 60 80 100 
File Server Active fon 14,95 
Bill Goodman Standby Mon 1.42 | | 
| Mark Ellison Standby Hon 8.25 | 
| William Griffith Standby Mon 4.05 | | 
| Print Server tandby Non 5.90 | ! 
Michael Harley  Standb | 


Anthony Serrao Standby Mon 


James Wylie Standoy Mon 0.47 | | 
Fred Biddle Standby Mon 0.74 | 
Tom Brown Standpy Mon 3.66 
Robert Hayes Standoy Mon 0.82 | 
Miles Russell Standby Yon 1.39 
Steven Anderson Standby Non 8.67 


Hit Eso to quit, any key to continue 


Figure 44. Ring order report. 
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ROUTELEN 


The report based on ROUTELEN.SCR shows the route length distribution information. It 
shows the number of frames that have different route lengths and indicates the 
percentages of these frames. The graph illustrates the percentages. Figure 45 is an example 
of a report based on the ROUTELEN script. 


| 

| Route Lengths 

i] 

| This report supplies route length distribution information. 
| 


andr , Rnmaamd fal rata on 4 
Length Frames Percent 0 20 4 60 80 100 

| U J 
| 1 , 185 | 
= S | 
| 2 fs) 
j fe | 
3 4 549 | 
4 0 | 
| U | 
| 5 0 | 
| 6 ) | 
<i fal | 
A ps | 

8 0 

m pS 

wi u 

45 ps 

BEA uv 

Over 12 0 


Hit Esc to quit, any key to continue 


Figure 45. Route lengths report. 
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ROUTEPTH 


The report based on ROUTEPTH.SCR shows the route path distribution information. It 
shows the number of the frames between the local and remote networks. Figure 46 is an 
example of a report based on the ROUTEPTH script. 


This report supplies route path distribution information. 


100 


Rem-Rem 
Loc-Other 
Rem-Other 


Hit Esc to quit, any key to continue 


Figure 46. Route paths report. 
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SAPS 


The report based on SAPS.SCR shows the SAP protocol type distribution information. The 
report includes a list of SAP protocols, the number of bytes per SAP protocol type, and the 
percentage of each protocol type. The graph illustrates the percentages. Figure 47 is an 
example of a report based on the SAPS script. 


SAP Protocols | 


LOLU 


This report supplies SAP protocol type distribution information. 


SAP Bytes Total 0 20 40 60 &0 100 
| ! L | i | inn oll | | 
BPDU 13.21 4 
Banyan 6.79 - 
TBY_NM 6 31.895 
IP 1 1,02 + 
So 821168 
NetBIOS 5 6.78 -=— | 
Novell 0 0.00 5 | 
SNA 2 0.38 += | 
SNAP 0 0.67 48 
Global 2 0.53 48 
MA 5 0,23 38 
Hit Eso to quit, any key to continue 


Figure 47. SAP Protocols report. 


TALKERS 


The report based on TALKER.SCR shows statistics for the 10 stations that transmitted the 
most traffic during the most recent monitoring session. 


Stations are sorted in descending order by the number of bytes transmitted and filtered by 
sort position. The report includes the 10 stations that transmitted most traffic. 


The report shows the following types of general information: 


Time monitoring started 

Time monitoring stopped 

Duration of the monitoring session (elapsed time) 
Total number of stations 


Time when the report was generated. 


Statistics shown for each station include: 


Sort position 
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* Station’s name 

* Number of bytes from the station 

* Number of soft error report frames from the station 
* Average size of the frames from the station 


* Percentage of relative network usage by the frames from the station. 


Figure 48 is an example of a report based on the TALKERS script. 


fe ) 

| 

Too 10 Talkers | 

| 

This report provides statistics for the 10 stations which have 

transmitted the most traffic. The stations are sorted by bytes 

| transmitted. | 

| 

Monitoring Started: Jot 04 09:52:32 Total Stations: 26 | 

Monitoring Stopped: Oct 04 10:19:47 | 

Elapsed Time: 0 day(s) 00:25:45 

Report Generated: Oct 04 10:19:47 

é 

Name Bytes Errors Size % Rel | 

1 Denise Martin 11, 190, 778 0 1748 14.46 | 

2 File Server 14, 127, 643 30 126 14.38 | 

3 Ed Hicks 9,177, 893 2 147? 11.86 | | 

4 Linus Stanwick 8549, 913 3. 1362 11.05 | | 

5 Mark Ellison 7, 45, 412 3 i188 9.63 | | 

| 6 Steven Anderson 6, 108, 827 12 975 7,89 | | 
| | 7 Print Server 4 351, 204 38 72 5.62 | 

| Hit Esc to quit, any key to continue 


Figure 48. Talkers report. 
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USERLIST 


The report based on USERLIST.SCR lists the physical addresses and names of all stations, 
sorted by address in ascending order. No filters are used to limit the number of stations. 
This report is useful for compiling the names assigned to all addresses. You can use it to 
set up the Token-Ring Monitor station data file, STARTUP.TRD. Figure 49 is an example 
of a report based on the USERLIST script. 


This report lists the physical each station. 


| 
| The stations are sorted by ; | 
| | 
| 


Ann 
UO 


Anan 
0000004E20C 


ane 
000000 


Hit Esc to quit, any key to continue 


Figure 49. Userlist report. 


USERS 


The report based on USER.SCR shows transmission and reception statistics for all stations, 


sorted in ascending order (alphabetically) by name. No filters are used to limit the number 
of stations. 


The report shows the following types of statistics: 
* Time monitoring started 


* Time monitoring stopped 


* Duration of the monitoring session (elapsed time). 


Statistics shown for each station include: 


* Sort position 
* Station’s name 


* Number of frames from and to the station 
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* Number of soft error report frames to and from the station 
* Number of bytes from and to the station 
* Average size of frames from and to the station 


¢ Percentage of relative network usage by the frames from and to the station. 


Figure 50 is an example of a report based on the USERS script. 


| This report provides combined transmit and receive statistics for all 
stations. The stations are sorted by name. 


Monitoring Started: Oct 04 09:52:32 


Monitoring Stopped: lot 04 10:28:52 | 
| Elapsed Time: 0 day(s) 00:36:20 
1 | 
Name Frames Errs Bytes Size % Rel | | 
| | 1 Alex Zwick 7 104 1.68 
| | 2 Anthony Serrac a 47 0,81 
| 3 Barbara Lemmon 6 138 2.25 
4 Barney Ingram Q V2 86185 
5 Bill Goodmar 0 127) 2.07 
6 David Brooks al (Ales Oni 
| 7 Denise Martin 0 926 15.17 
| 8 Ed Hicks 2 782 12.60 
| 9 File Server 36 267 = 61.72 | 
| 10 Fred Biddle 0 63 1.06 | 
| Hit Esc to quit, any key to continue | 


Figure 50. Users report. 
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USERSCSV 


The report based on USERSCSV.SCR shows the same information as the USERS report, 
but in a delimited format that allows you to import the information into spreadsheets, 
databases, or other applications that use the CSV format. Figure 51 is an example of a 
report based on the USERSCSV script. 


WonD, wow 


"Name", "Frames", "Errs", "Bytes", "Size", "% Rel" 
"Alex Zwick 16060, 
“Anthony Serrac 
| “Barbara Lemmon ", 
| “Barney Ingran ", 
| “Bill Goodman 
"David Brooks 


1634336, 101, 

785922, 4 0.81 
2183181, 138, 
1813647, 112, 
2004067, 127 
1128404, 71, 


"Denise Martin ", p 928, 15.19 
"Ed Hicks ei d 702, 12.63 
| “File Server ie 36, 50682 257, 61.78 
| "Fred Biddle 63 06 


"George Stanley ", 
"Helene Nilici 


"Jack Clayton =", , 1023800, 65, 5 
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Figure 51. Users report (CSV format). 
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Generating a Report 


To generate a report, you must first load the report script that specifies the statistics you 
want to include. When you display, print, or save this report, the Token-Ring Monitor 
automatically inserts the statistics from the current monitoring session. 


Loading a Report Script 
To load a report script: 


1. Move to Reports in the main menu. 


2. Move to Load and press Enter to display the list of available reports, including the 
Token-Ring Monitor sample report scripts and any other reports that have been 
saved. 


3. Move to the report you want to load and press Enter. 


You can edit a report script once you load it. In addition, you can do any of the following 
to the report generated by the script: 


* Preview it on the screen 
¢ Print it on a printer 
* Save it to the disk 
* Clear its contents. 
Previewing a Report 
You can preview a report by printing it to the screen. 
To preview a report: 


1. Load the desired report script. 


2. Move to Edit and press Enter to display the Report Script Editor view, which contains 
the script you loaded. 


3. Press F9 (Screen test) to display the report generated by the script. If the report consists 
of more than one screen, press any key to see the next screen. To return to the script, 
press Esc. 


Printing a Report 
You can print the report on a printer you designate. You can also specify the number of 
lines to be printed before the Token-Ring Monitor inserts a page break and a report 
header. 
To print a report: 


1. Load the desired report script. 


2. Move to Print, then to the desired printer. Press the Spacebar. 


109 


Sniffer Advanced Token-Ring Network Monitor User’s Manual 


3. Do you need to change the number of lines? 
* If yes, move to Page size =, and press Enter. In the dialog box that appears, type 
the desired number of lines, or turn off the option by typing 0, and press Enter. 
If this option is turned off, the Token-Ring Monitor does not insert any page 
breaks in the printout. 


If the number of lines you specify exceeds the length of the page, the Token-Ring 
Monitor prints the number of lines you specified, overlapping the page break. 


* — Ifno, go to step 4. 


4. Youcan print the report in delimited format, which excludes all embedded commas 
in figures. For example, 1,234 is printed as 1234 in delimited format. For further 
information on delimited format, refer to “Saving a Report to Disk” in this chapter. 


An x mark preceding the Delimited format option indicates that the format is not 
selected; a V mark indicates that it is selected. Do you accept the option’s setting? 


* If yes, go to step 5. 
° If no, move to Delimited format and press the Spacebar. 


5. Move to Print in the main menu and press Enter. 
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Saving a Report to Disk 


You can save a report to preserve the statistics generated during a monitoring session in 
either normal file format or the CSV format. 


Normal File Format 


The normal file format is the default format. Numbers that are 1,000 or greater are printed 
with embedded commas (for example, 1,100,000) in normal file format. Figure 40 earlier 
in this chapter is an example of an Errors report in normal file format. 


CSV Format 


If the CSV format is chosen, embedded commas within fields are removed, and 
pagebreaks within the report are eliminated. Figure 51 is an example of a report in CSV 
format. 


The CSV format allows you to import the file into other applications, such as spreadsheets 
and databases. Using the CSV format eliminates the need to write a macro to export your 
Token-Ring Monitor report files. 


For example, you might want to show the comparative usage of your network servers in 
a pie chart. After creating a report that provides those statistics and then importing that 
report into a spreadsheet application program, use the spreadsheet program’s graphics 
capabilities to create a pie chart based on your report. 


To separate the fields from each other, insert a comma between the fields in the report 
script. Also, if a field is a character string (for example, a station name), use quotation 
marks to enclose the character string. 


Note: If the application program into which you want to import data requires additional 
formatting, make these changes in your report script. Refer to the documentation of the 
application for details about required filenames, field formats, and other considerations. 


For an example of a report in CSV format, preview the USERSCSV report that is shipped 
with the Token-Ring Monitor. 


To save a report to disk: 
1. Load the desired report script. 
2. Move to Print, then to File, and press the Spacebar. 


3. Tosave the report in the normal file format, make sure that an x displays to the left of 
the Delimited format option. To save the report in CSV format, make sure that a V 
mark appears to the left of the option. If necessary, press the Spacebar to toggle the 
setting of Delimited format. 


4. Move back to Print and press Enter to display the dialog box. 
5. Type a filename and press Enter again. 


The Token-Ring Monitor saves the report to the C:\CAPTURE\TRREPT directory and 
appends the extension RPT or CSV to its filename, depending on the file format. 


 ————————— 
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Creating or Modifying a Report Script 


If existing report scripts do not meet your needs, you can create a new report script or 
modify an existing script. For example, to replace the “Bytes” column in the TALKERS 
report script with “Frames,” simply change the column header and the associated code. 
You can make any substitutions you wish in this way to create customized reports. 


You can create and modify report scripts with the Report Script Editor view. The 
procedure includes the following tasks: 


* Clear the contents of an existing report script. 

* Enter text. 

* Define which statistics (fields) to include in the report. 

* Define which field to use to sort the report, in either ascending or descending order. 


* Define one or two filters to further refine the report so that the report contains only the 
stations that you are interested in. 


* Determine the report’s appearance by adding or deleting blank lines, or by adding 
special characters such as horizontal and vertical lines. 


° Preview the report. 

* Save and rename the report script for future use. 
To create a report script: 

1. Move to Reports in the main menu. 


2. Move to Edit and press Enter. 


Unless you loaded a report script during the current monitoring session, a blank 
report script appears in the Report Script Editor view. If you previously loaded a 
script, that script appears. 


3. To clear an existing report script, press Fé (Edit options). The edit options appear. 
4. Move to Clear and press Enter. The message “Clearing report script” appears. 

5. Press F6 (Return) to display a blank report script. 

To edit a report script: 


The procedure that follows shows how you edit the fields in a report script. The TALKERS 
report script is used as an example. The procedure shows just one way to edit a report 
script. Once a report script displays, you can vary the order in which you do various tasks 
or skip those tasks not relevant to your needs. 


1. Create a blank report script according to the preceding procedure. 


2. To define which statistics to include, position the cursor where you want the field to 
appear. Then press F2 (Insert field) to display the list of available fields. The screen 
shown in Figure 52 appears. For further information on how to edit a report script, go 
to the next procedure. 
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Figure 52. Fields that can be inserted into a report script. 


Move to the first field you want to display and press Enter. (For the Talkers report, you 
would select Sort Pos under the heading Station, which represents the sort position of 
the station.) 


Some of the fields provide several options for you to further customize the field. For 
example, after you select the “% Usage” field, a window appears, which contains 
“Absolute” and “Relative.” These options correspond to the absolute and relative 
percentage of network usage. Use the cursor keys.to move to the appropriate option 
and press Enter. 


A code (for example, @ss@) appears on the screen. When the Token-Ring Monitor 
compiles the report, it automatically substitutes a value for that code. 


Position the cursor for the next field, with at least one space after the previous field. 
Also, be sure that the end of the field does not exceed the end of the line. 


Press F2, select the second field you want to display, and press Enter. (For the Talkers 
report, you would select Name under the heading Station). 


Repeat steps 3, 4, and 5 until you have defined all the fields. 


To enter text, use the cursor keys to move the cursor to the desired place and start 
typing. For example, you might want to enter explanatory text or headers for the fields 
you selected. The upper-right corner identifies the cursor position by row and column 
to help you place the cursor precisely. The DEL key deletes the current character. The 
Ins (Insert) key inserts characters; if you have not pressed Ins, the character you type 
overwrites the current one. 
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Figure 53 shows the codes for the fields of the Talkers report and the explanatory text. 
The first letter of each code identifies the field that the code represents. For example, 
the code FBYTE represents the bytes in the From field and the code TBYTE represents 
the bytes in the To field. You can define more fields than those in Figure 53. Each 
report script can contain up to 58 lines. 


f 
| 
| 


REPORT SCRIPT EDITOR———————TALKERS. SOR———————Row:  1—Col: 1- 


the 10 stations which have 


tin A earten hy hyra 
he stations are sorted Dy bytes 


_———————— a ee 
| 2Insert{slnser tude letel 6 i rea es 
me Help § field§ -. line e optionsg Chars § charg — test 


Figure 53. Talkers report script. 


Note: If you try to enter the @ symbol in your report, the Token-Ring Monitor displays 
@@ to differentiate your input from the keyboard from the @ symbols used as 
delimiters in the field codes. When you print, the report prints correctly with a single 
symbol. 


8. Tosort the statistics in the report, press F6 (Edit options). A list of edit options appears. 


9. Move to Report settings, and then to Sort by to display the sort options. A display as 
shown in Figure 54 appears. 
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Figure 54. Options for sorting stations in a report. 


Follow these steps to specify how the statistics are sorted: 


a. Move to and select the To, From, or Both option by pressing the Spacebar. This 
option is applicable if the sort key (to be selected in step c) is related to the traffic 
direction. For example, if the sort key is Frames, the To, From, or Both option 
determines whether frames sent to, received by, or both, are used as the sort key. 
If the sort key is Name, this option does not affect how the stations are sorted. 


For the Talkers report, select the From option to sort the stations according to the 
amount of traffic from the stations. 


b. Move to and select either Ascending or Descending to select the sort order. 
For the Talkers report, select the Descending option. 
c. Move into the list of sort keys and press the Spacebar. 


For the Talkers report, select Bytes. 


As aresult of these specifications, the Talkers report displays the stations that transmit 
the most bytes in descending order. 


10. Choose the type of station to be included in the report: 


a. Toinclude only the stations that have sent or received frames, select the Active stn 
only option for Report settings. A V mark preceding the option indicates that it is 
selected. An x mark indicates that it is not selected. If the option is not selected, 
every station, regardless of whether it has received or sent traffic, is included. 


b. To include only the inserted station, select Inserted stns only. A V mark preceding 
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the option indicates that it is selected. An x mark indicates that it is not selected. A 
station whose station status is active monitor, standby monitor, or snooper is 
considered an inserted station. 


11. Select filters to limit the stations to be displayed in the report. Follow either of these 
steps to choose the filter, depending on the number of filters you need: 


To use one filter, move to Filter 1. If necessary, press the Spacebar to display the 
V mark. Then move to Filter 2. If necessary, press the Spacebar to display the x 
mark to disable the second filter. 


If you want to use a second filter, decide whether you want the statistics to pass 
either filter or both filters, and select the appropriate operator option (OR or 
AND). Then move to Filter 2 and make sure it is selected (that is, aV mark should 
precede the Filter 2 option). 


If you select two filters with the AND option, the station must fulfil the conditions 
defined by both filters to be included in the report. If you select the OR option, the 
station is displayed if it meets the conditions of either filter. 


12. To specify the conditions for a filter, move to the panel to the right of the Filter option. 
There are two lists on the panel. Follow these steps to select the items on the lists: 


A. You can limit the stations to be included in the report based on any of these criteria: 


Sort Position, Name, Partner’s name, Frames, Errors, Bytes, Average size, First 
activity, Last activity, Elapsed activity, Address, Absolute usage, and Relative 
usage. They are shown in the second list on the panel. 


For example, you can specify that the station be included only if its frame size is 
between 100 and 1,000. 


To select the criterion, follow these steps: 


a. Move to the desired item on the second list and press Enter. A dialog box 
appears. The dialog box shows the default minimum and maximum values. 


b. Move to the value you want to modify, then press Enter. Another dialog box 
appears. 


c. Type the desired value and then press Enter. The dialog box with the values 
that you set appears. Press Esc or F6 to return to the menu. 


(For the Talkers report, you would select the Sort Position as Filter 1 and specify a 
minimum value of 1 and a maximum value of 10 to include the top 10 users.) 


The first list determines the direction of traffic to which the criterion you specified 
in step A applies. If you specified Frames in step A, determine whether this 
condition should apply to the traffic from or to the station, or the traffic in both 
directions. For example, you can specify that the Token-Ring Monitor count only 
the stations transmitting frames whose size is between 100 and 1,000 bytes. 


To specify the direction, move to To, From, or Both in the first list. Then press the 
Spacebar. 


Note: After changing a filter value, immediately press Cursor Left to return to the 
Filter 1 option. This ensures that you do not accidentally change the new value by 
viewing other filter values. 


If you are specifying two filters, repeat this step for the second filter. 


13. To refine the report’s appearance, you can add or delete blank lines or special 
ee ee 


14. 


15: 


16. 
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characters like up, down, right, or left ruling lines. 


a. To add or delete lines, use the F3 (Insert line) or F4 (Delete line) keys. 


To add headers, use the Arrow keys to position the cursor above the fields you 
want to describe. Then type in the text. 


c. Toadd special characters, press F7 (Chars) to display a list of available characters. 
Move to the desired character and press Enter. To repeat the character, use the 
cursor keys to position the cursor on the character and press F8 (Repeat chars) to 
make a continuous line or other special display. 


To see how the report will appear with statistics, press F9 (Screen test). 


Press Esc to return to the script. You can now make any additional changes to the 
report script. 


To print or save the report, press Fé (Edit options). A list of edit options appears. Move 
to Print, and then either designate a printer or choose File. (See “Printing a Report” 
and “Saving a Report” earlier in this chapter for a description of the associated 
options.) 


Recommendations on Report Editing 


The following is a list of recommendations that might help you edit a report script: 


If you are modifying an existing report script, remember to edit the text preceding the 
statistics after you set up the fields so that the text correctly describes the report. 


It can be helpful to view the statistics if the sort key is consistent with one of the fields 
included in the report script. 


For example, the LISTENRS report script includes the TBYTE field, which represents 
the number of bytes sent to each of the stations in the report. It is recommended that 
you sort the statistics using the To option. In this way, the statistics represented by 
TBYTE are sorted in descending or ascending order, depending on your choice. 


If you sort the statistics using the From option, the stations are arranged according to 
the amount of traffic transmitted. This makes the report less useful, because it shows 
the stations that transmit most traffic, yet none of the statistics in the report are related 
to transmissions. 


Use the AND operator carefully if you are defining two filters. When used correctly, 
it can eliminate the stations that you are not interested in. However, it may yield 
unexpected results if you inadvertently define conflicting conditions for the filters. 


The following are examples showing how the filters interact with the AND operator 
for the LISTENRS report script: 


Example 1 


For filter 1, To and Frames are selected. The minimum and maximum frame sizes are 
0 and 500, respectively. 


For filter 2, To and Errors are selected. The minimum and maximum numbers of 
errors are 1 and 65,535, respectively. 


The report generated by the LISTENRS report script counts only the stations that 
transmit frames whose average size is 500 bytes or less and that have transmitted 
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between 1 and 65,535 error frames. You are eliminating the stations that have not 
transmitted error frames as well as the stations that transmit large frames. 


Example 2 
Filter 1 has the same conditions as in Example 1. 


For filter 2, To and Frames are selected. The minimum frame size is 600; the maximum 
is a value that is greater than 600 (for example, 1,000). 


The report generated by the LISTENRS report script contains no statistics because no 
station can meet the criteria defined by these filters. That is, no station can transmit 
frames whose size is 500 bytes or less and 600 bytes or more. 


Example 3 


For filter 1, Sort position is selected. The minimum and maximum values are 1 and 5, 
respectively. 


For filter 2, To and Errors are selected. The minimum and maximum numbers of 
errors are 100 and 500, respectively. 


The report generated by the LISTENRS report script would probably contain no 
statistics. If the statistics are sorted by the frames received by the stations, a station is 
displayed only if it is one of the top 5 stations that receive most traffic and it has 
transmitted between 100 and 500 error frames. 


Saving a Report Script 


118 


When you finish editing a report script, you can save that script for future use. The original 
script you used asa basis is not changed; instead, you save the edited version under a new 
name. 


To save a report script: 


1. With the report script displayed, press Fé (Report Options), move to Save, and press 
Enter. 


2. Inthe dialog box that appears, type the report script name and press Enter. 


The Token-Ring Monitor saves the report script and assigns it the extension SCR. The next 
time you load report scripts, this script appears as one of the options. 
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Generating Reports from the Command Line 


When the background program TRMONDRYV is running, you can generate and display 
reports from the DOS command line without running the Token-Ring Monitor in the 
foreground. 


To generate a report from DOS: 


At the C: prompt, type TRMON, followed by REPORT and the pathname of the report 
script. 


For example, to display the Errors report, you would type: 


TRMON REPORT \CAPTURE\TRREPT \ERRORS.SCR 


To redirect the output of the command to a file, include the name of the file in the 
command as shown in the following example: 


TRMON REPORT \CAPTURE\TRREPT\ERRORS.SCR > FILE 
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Chapter 8. Establishing a Baseline for Your Network 


Determining what is wrong with the network is much easier when you are familiar with 
typical network patterns before a problem occurs. Significant deviations from these 
patterns often indicate a problem. To decide whether such deviations exist, do the 
following: 


* Name the stations on the network. 
Refer to Chapter 5, “Managing the Station Data file” for further information. 


* Become familiar with normal traffic patterns. 


This chapter describes the tests that produce results to be used as a baseline for your 
network. It does not, however, provide detailed interpretation of statistical displays and 
views generated by the Token-Ring Monitor. This information is provided in Chapter 10. 


The procedures in this chapter assume that you already know how to move through 
menus, select options, and define values. 


Gathering History Statistics 
To establish a picture of typical network patterns: 


1. Monitor all stations at 30-minute history intervals over a period of time, between one 
day to one week. 


Note: Longer intervals like 30 minutes are often more meaningful because they reduce 
the effects of short-term fluctuations. 


2. Select Global history under Display to look at the Global History Statistics view. The 
statistics allow you to analyze the network usage during various time periods. 


Alternatively, enable the Log to disk option under History in the main menu. The file 
HISTORY.LOG is created in the C:\CAPTURE\TRREPT directory to store the statistics in 
the Global History Statistics view. Use a text editor to view and print out HISTORY.LOG. 


It might be useful to log history statistics at different times of the year to discern network 
usage patterns. For example, you might want to know whether network traffic is heavier 
toward the end of each fiscal quarter within your organization. 


To display history statistics for a particular station: 
1. After monitoring the network over a period of time, select Stn under History. 
2. From the station list, select a station for which history statistics will be displayed. 


3. Select Station history under Display to look at the history statistics for the selected 
station. 


‘When you display a station’s history statistics, you can specify whether the statistics are 
compiled according to the amount of traffic received or transmitted by the station, or both. 


In most cases, use the Both option to show a more accurate picture of network activity. 
With this option, the Token-Ring Monitor displays history statistics that reflect the traffic 
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to and from the station. You can use this information to assign stations so as to balance 
traffic between servers. 


An example of when the From option is useful is when you display or sort by errors. This 
provides the most accurate picture of which stations are transmitting soft error report 
frames. The To option might be useful for comparing the sizes of frames sent to the servers 
to those transmitted by the servers. 


To generate a history report for a particular station: 


To maintain a permanent record of the history statistics for a particular station, create a 
report script and generate a report for these statistics. 


For example, if ServerA generates the most traffic on the network, you might want to 
know its network usage at different times of the day over a period of time (for example, a 
week). To generate a history report for ServerA, follow these steps: 


1. Select Edit under Report to display a blank report. 
2. Enter text that describes the content of the report. 


3. Insert fields such as the current time, frames from and to the server, and absolute 
network usage, and error frames. 


4. Press F6 to display the edit options. 

5. Select Report settings to set Filter 1. Select Name to limit the report to ServerA. (That 
is, set both the minimum and maximum values of Name to “ServerA.”) Make sure 
that Filter 2 is disabled. 


6. Select Save to save the script under a filename of your choice. 


7. Select Auto print to print the report to a single file on the disk every hour. Set Start 
time to a time when you want the Token-Ring Monitor to start printing the report. 


8. Enable the Restart monitor option so that the Token-Ring Monitor starts a new 
monitoring session each time it prints the report to the disk. 


After monitoring the network for a week, print out the file that contains the report. The 
report consists of the hourly history statistics for ServerA in the past week. You can now 
see the traffic patterns of this server at different times of the day. 


Establishing a Baseline for Your Network 


Protocol-Specific Station Tests 


It is useful to test protocols to which each station responds so that when connectivity 
problems occur in the future, you know which station normally responds to a particular 
test frame. 


To perform a protocol-specific station test: 

1. Stop monitoring. 

2. Select Station test. 

3. Choose the station from the station list. 


4. Select the protocol with which you want to test the selected station. The available 
protocols are MAC, IEEE 802.2, NetWare, and NetBIOS. If you select NetWare or 
NetBIOS, be sure that a second network interface card has been installed in the Sniffer 
analyzer, which supports these protocols. 


5. Record the test result. 


If the selected station responds to a test frame of a particular protocol, the Token-Ring 
Monitor displays a message indicating whether the station responded. 


Examining Typical Frame Size Distributions 


It is useful to know the typical frame size patterns on the network. Suppose a majority of 
the frames on your network typically fall in the range between 33 and 64 bytes. After you 
installed a new network application (for example, a file transfer program), most frames 
now fall in the range between 2,049 and 4,096 bytes. This change indicates that the 
introduction of the program had an impact on network traffic. This information can help 
you decide whether modification of the network configuration is required. 


To examine the frame size distribution, monitor the network over a period of time. Then 
select Frame size under Display to look at the Frame Size view. If you want to look at the 
frame size distribution over a period of time, generate a report based on FRAMSIZE.SCR. 


If you want to know the average frame size for each station, select All station under 
Display. Specify that the statistics be sorted by the average frame size. 


Examining the Transmit Timer 


With the access control scheme on a token-ring network, a token is always in circulation. 
If a message is already on its way from one station to another, the token is set as a busy 
token. A station must first get a free token before it can transmit on the network. 


The time a station needs to wait for a free token before transmitting a frame is longer as 
the network becomes busier. The transmit timer on the Token-Ring Monitor indicates the 
length of time between two frames sent to the network, one after another. 


It is recommended that you know the length of the waiting time during normal and peak 
hours. In the future, if you notice that the waiting time has become significantly longer, 
you might want to consider changing the network configuration to speed up the 
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transmission process. For example, you might want to divide one network segment into 
two or three segments. 


To examine the transmit timer, stop the monitoring session and then select Transmit Timer 
on the main menu. A screen display shows the amount of time the Token-Ring Monitor 
waits between the transmission of two frames. The time is measured in milliseconds. 


Note: The value of the transmit timer varies with the type of PC. 
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Chapter 9. The Token-Ring Monitor Files 


The Token-Ring Monitor consists of three executable program files and several data files. 
This section lists the Token-Ring Monitor files and summarizes when these files are read 
and written. 


Program Files 


The executable program files are TRMONCFG.EXE, TRMONDRV.EXE, and 
TRMON.EXE. They are stored in the C:\TRSNIFF directory. 


TRMONCFG.EXE is the configuration program that lets you change the network interface 
card settings and the monitoring parameters. You cannot run this program if 
TRMONDRYV is already running. This program is activated when you select Configure 
Token-Ring Monitor on the Token-Ring Monitor Selection menu. 


TRMONDRV.EXE runs in the background, controlling the network interface card and 
collecting data. It is loaded into RAM asa terminate-and-stay-resident (TSR) program. The 
amount of RAM used depends on the number of stations monitored and the number of 
history intervals. This program is activated when you select Run Token-Ring Monitor on 
the Token-Ring Monitor Selection menu. 


TRMON.EXE is the foreground application that includes the user interface through which 
you control most of the Token-Ring Monitor functions. It is activated when you select Run 
Token-Ring Monitor on the Token-Ring Monitor Selection menu. 


Data Files 
The data files contain the information the Token-Ring Monitor needs. They include: 


* TRMON.CFG 

* STARTUP.TRB 

* STARTUP-IEI 

¢ STARTUP.ITRIT 

* STARTUPIRA 

¢ STARTUP.TRD 

* TRMON.HLP 

+ *SCk 

Note: The Token-Ring Monitor creates duplicates of the STARTUP.TRA and 
STARTUP.TRD files when you change these files for the first time after starting the Token- 


Ring Monitor. The duplicates are called BACKUP.TRA and BACKUP.TRD, respectively. 
As a result, you can return to the previous version of the data files. 


The report scripts (*.SCR) are stored in the C:\CAPTURE\TRREPT directory; the other 
data files are stored in the C:\TRSNIFF directory. 


Note: The STARTUP.TRD and STARTUP.TRI files are also used by the Sniffer analyzer. 
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TRMON.CFG 


File type: 
Content: 


Read: 


Written: 


STARTUP.TRB 


File type: 


Content: 


Read: 


Written: 


STARTUP.TRI 


File type: 


Content: 


Read: 


Written: 


STARTUP.TRT 
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File type: 


Content: 


Binary. 
Configuration settings. 


When TRMONDERYV is loaded into memory. If this file is not found, an error 
message appears. 


When you run TRMONCFG.EXE. If TRMON.CFG is not found, 
TRMONCFG.EXE creates the file with the default settings. 


When you exit the Configuration Options view. 


Binary. 


Default settings for the user interface options, such as the values of various 
menu items. 


When you start the Token-Ring Monitor. If the Token-Ring Monitor cannot 
find this file, it uses the defaults. 


When you exit from the Token-Ring Monitor’s main menu. Any changes to the 
user interface options are saved. 


ASCII. 


Vendor addresses, each of which makes up the first six hexadecimal numbers 
of a station’s address. The Token-Ring Monitor is shipped with a set of 
addresses in STARTUP.TRI. The following is an example of an entry: 


manuf“ Vtalnk” = 48007c 
The maximum number of entries is 225. 


When you start the Token-Ring Monitor. It is also read by the Sniffer analyzer 
if you use its analysis function. 


When you save changes made with a text editor. (The Token-Ring Monitor 
does not automatically change this file.) 


ASCIL. 


All the SAP values in hexadecimal numbers. The Token-Ring Monitor is 
shipped with the default SAP values in STARTUP.TRT. The following is an 
example of an entry: 


sap “ISO” = fe 


The Token-Ring Monitor Files 


Read: 


Written: 


*SCR 


The maximum number of entries is 32; the maximum number of SAP labels is 
Be. 


When you start the Token-Ring Monitor. 


When you save changes made with a text editor. (The Token-Ring Monitor 
does not automatically change this file.) 


There are several report script files under the C:\CAPTURE\TRREPT directory (for 
example, HISTORY.SCR, ERRORS.SCR). 


File type: 


Content: 


Read: 


Written: 
STARTUP.TRA 
File type: 


Content: 


Read: 


Written: 


STARTUP.TRD 
File type: 


Content: 


Binary. 


Report script that the Token-Ring Monitor uses as a template when generating 
a report. 


When you choose Load for Report on the Token-Ring Monitor’s main menu or 
when you generate a report from the DOS command line. 


When you choose Save for Report on the Token-Ring Monitor’s main menu. 


ASCII. 


Station addresses and alarm thresholds. This file is not shipped with the Token- 
Ring Monitor; instead, it is created during the first monitoring session, when 
the Token-Ring Monitor adds any named stations it detects to this file and 
assigns them the default alarm thresholds. The following is an example of an 
entry: 


station C00000000001 alarms (usage 20%, badpkts 5, idle 1 mins, norsp 7 secs, 
priority 1) 


When you start a monitoring session. 

When you exit the Manage Station Information view after making changes. 
When you stop and then restart a monitoring session. 

When you edit the file with a text editor. 


When you exit the from the Token-Ring Monitor’s main menu. 


ASCII. 


Station names and addresses. You can enter station names automatically (if 
you use NetBIOS), with the Manage Stations Information view, or with a text 
editor. If you are running the LattisNet software, you can also use the 
information in its files. (See Appendix B, “Command Line Options.”) 


nn EEE UEIEEIEEIEEIEIUEEIEEES ESSE 
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The following is an example of an entry: 
station “NetBIOS” = c00000000080 


Read: When you start a monitoring session. It is also read by the Sniffer analyzer if 
you use the analysis function. 


Written: When you use the Probe for names function to add station names. 
When you exit the Manage Station Information view after editing names. 
When you edit the file with a text editor. 
When you use the Sniffer analyzer to modify the file. 


Note: You cannot delete the broadcast address, cOOOffffffff, from this file. You can, 
however, change the name for this address. The default name is Broadcast. 


5 

c 
DO 
cs 
Om xs. 
ES 
cx 
<6 
e) 
-= 


10 
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Token-Ring Monitor Menu Items 


Chapter 10. Token-Ring Monitor Menu Items 


This chapter describes each menu item in the order it appears in the Token-Ring Monitor's 
main menu, along with any associated options. For options that display additional 
information, such as the Global Statistics view associated with the Display option, there is 


also an explanation of each item in the view. 


This chapter does not discuss the use of function keys in each view (for example, F9 for 
freezing the screen). It assumes that you have learned how to use the function keys from 


the previous chapters. 


Transmit Timer 


Generates the Transmit Wait Time view, which shows the amount of time the Token-Ring 
Monitor takes to acquire the token before each transmission. Select Transmit Timer only 
when the Token-Ring Monitor is not monitoring. Figure 55 is an example of the Transmit 


Wait Time view. 


FIRANSMIT WAIT TIME: 
| sit Transmit Wait Time: 24.2 milliseconds 
y 4 
a: 16 
i 
| t 100} : 
T et} 
i 4 | 
mC pp) — 
” 6 x0 40 30 20 40 ) 
i Seconds 


J 


up down display 


Figure 55. Transmit Wait Time view. 


The following list explains the terms used in the display: 


© Current Transmit Wait Time is the amount of time in milliseconds that the Token-Ring 
Monitor waited to acquire the token for the most recent transmission. 


e Wait Time is used on the vertical axis of the bar graph. It indicates the amount of time 
in milliseconds that the Token-Ring Monitor waited to acquire the token for each 
transmission in the past 60 seconds. The Token-Ring Monitor transmits 20 frame per 
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second and averages the wait times. The time intervals are marked on the horizontal 
axis of the graph. 


Station Test 


Tests for station response, using the protocols listed below. To use the NetBIOS or 
NetWare option, you need to install a second network interface card and load the NetBIOS 
or NetWare software for that card. 


If the station responds to the test frame, a message similar to the following appears: 


“File Server responded.” 


Options 

To= Displays the name or address of the station to be tested. If you press Enter 
after selecting this option, a list appears. Choose the station you want to 
test. To move through the list quickly, type the first character of the 
station’s name. 

MAC Sends a test frame at the MAC level. 


TEEE 802.2 Sends an 802.2 test frame. 
NetWare Performs a NetWare configuration request command. 
NetBIOS Performs a NetBIOS remote status request command. 


Note: The Token-Ring Monitor can perform a station test using the NetWare or NetBIOS 
protocol when it is monitoring the network. You must, however, stop the monitor before 
initiating a station test for the MAC or IEEE 802.2 protocol. 


Monitor Filters 


Determines which stations and which type of frames are to be monitored. You can change 
the settings of Monitor filters only when the Token-Ring Monitor is not monitoring. 


Options 
All stations Monitors all stations. 


Stn = Displays the name or address of the station to be monitored. If you press 
Enter when this option is selected, a station list appears. Choose the station 
you want to monitor. To move through the list quickly, type the first 
character of the station’s name. 


All frames Monitors both LLC and MAC frames. 
LLC frames Monitors only LLC frames. 
MAC frames Monitors only MAC frames. 


By default, Monitor filters is set to All stations and All frames. 
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Specifies the history interval and designates a station for which history statistics are 
collected. The history interval determines how often the Token-Ring Monitor records 
history statistics. Configure the total number of intervals in the Configuration Options 


view. 


Changing the setting of a History option erases any previous history statistics in memory. 
To save them, generate a report or log history statistics to disk. 


Options 


Stn 


Intrvl 


Align history 


Displays the name of a station for which the Token-Ring Monitor collects 
statistics. If you press Enter when this option is selected, a station list 
appears for you to choose a station. To move through the list quickly, type 
the first character of the station’s name. 


Specifies the length of a time interval during which the Token-Ring 
Monitor accumulates statistics. 


To specify the value, press Enter to displays a dialog box. Specify the time 
in the hh:mm:ss format. The value can range from 5 seconds to 24 hours. 


If it is not selected, the Token-Ring Monitor starts collecting history 
statistics immediately. 


If it is selected, the Token-Ring Monitor starts collecting history statistics on 
the next interval boundary. For example, if you set Intrv] to 10 minutes and 
the current time is 02:21:00, the Token-Ring Monitor starts collecting 
statistics at 02:30:00. However, you must follow these guidelines to set 
Intrvl for Align history to take effect: 


¢ If Intrvl is 24 hours, the Token-Ring Monitor starts collecting statistics 
at midnight. 


e If Intrvl is 12 hours, the Token-Ring Monitor starts collecting statistics 
at noon or midnight. 


e If Intrvl is any number of hours (for example, 1 hour, 2 hours), the 
Token-Ring Monitor starts collecting statistics at the beginning of the 
next hour. 


e If Intrvl is 5, 10, 15, 20, or 30 minutes, the Token-Ring Monitor starts 
collecting statistics on the next specified boundary. For example, if the 
current time is 05:13:00 and you set Intrvl to 30 minutes, statistics 
collection will start at 05:30:00. 


e If Intrvl is specified in minutes and its value is not one of those listed 
above, the Token-Ring Monitor starts statistics collection at the 
beginning of the next minute. For example, if the current time is 
05:13:25, and you set Intrv] to 2 minutes, the Token-Ring Monitor starts 
collecting statistics at 05:14:00. 
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Log to disk 


e If Intrvl is 5, 10, 15, 20, or 30 seconds, the Token-Ring Monitor starts 
collecting statistics on the next specified boundary. For example, if the 
current time is 05:13:25, and you set Intrvl to 15 seconds, the Token- 
Ring Monitor starts collecting statistics at 05:13:30. 


If Intrvl is set to a value other than those described above, the Token-Ring 
Monitor starts collecting statistics immediately. 


When selected, this option writes global history statistics at each history 
interval to a file on disk named HISTORY.LOG, which is in the 
C:\CAPTURE\TRREPT directory. At midnight, this file is renamed to 
GHYYMMDD.LOG (YYMMDD represents the year, month, and day). The 
Token-Ring Monitor then clears the contents of HISTORY.LOG so that it 
can store to this file the history statistics for the next day. 


When Delimited format is selected, the file is in CSV format, which is 
compatible with spreadsheet applications. In this format, embedded 
commas within numbers are eliminated. Also, the file is stored in comma 
delimited format, and the filename is HISTORY.CSV. 


When Delimited format is not selected, the file is in ASCII text format. 


Both HISTORY.LOG and HISTORY.CSV contain the same information as 
shown in the numeric Global History Statistics view. 


By default, Stn is set to Broadcast and Intrvl to 00:15:00. Align history is selected, but Log 


to disk is not. 
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Display 


Display generates a variety of screens containing network statistics. Each display is called 
a “view.” The exact information in each view depends on the options you choose. All 
views include the current date and time in the upper-right corner of the screen. 


Options 


The following is a list of options for Display, which allow you to specify the type of view 
to be generated: 


Global statistics Displays traffic statistics for the network as a whole. 
Single station Displays traffic statistics for a specific station. 
All stations Displays selected statistics, sorted according to your specifications, 


for all stations. 
Frame Sizes Displays a distribution of frame sizes. 
Routing info Displays statistics on routed frames. 


SAP protocol types Displays the numbers of frames or bytes according to the type of 
SAP. 


Alarm log Displays a list of alarms generated in the current monitoring session 
that have not been cleared. 


Global history Displays a history of activity for the entire network. 
Station history Displays a history of activity for a specific station. 


Except for Frame sizes and Alarm log, you can determine how these options display the 
statistics (for example, in the numeric or graphic format). The following subsections 
describe the views generated by these options. 


The Class option specifies whether the statistics in a view are based on the frames sent to 
the station, from the station, or both. This option applies when you display a single station 
(in the graphic format), all stations, or station history. 


The Network Usage option specifies whether the statistics are absolute (a portion of the 
total network capacity) or relative (a portion of the total network traffic). This option 
applies when you display a single station, all stations, or station history. 
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Display Global Statistics 


This view provides a high-level view of network activity for all stations for the current 
monitoring session. 


Options 

Numeric Displays global statistics as columns of numbers, including updated traffic 
counts, error counts, and timestamps. Numeric is the default setting. 

Graphic Displays traffic counts in the top portion and a graph of absolute network 


usage over a 60-second period in the bottom portion. 


Global Statistics in Numeric Format 


Figure 56 is an example of a Global Statistics view in the numeric format. 


LOBAL STATISTICS—————________ Oct 02 17:04:5 


Traffic Counts 


Error Counts i | 


Operating Normally 


6Disply rreeze10 Stop) | 
Help Menus fMoptions displayiuoni tor am 


Figure 56. Global statistics (numeric view). 


Traffic Counts 
The Traffic Counts column is divided into two parts. 


The following list explains the terms in the left column. All the statistics in this column 
have been accumulated since the current monitoring session started. 


Maximum Inserted Stns Highest number of inserted stations at one time in the 
current monitoring session. An inserted station is one 
whose status is active monitor, standby monitor, or 


eee ee SS 
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Total Stations 


Average Usage 
Total Frames 
Total Bytes 


Avg Frame Size 


Token-Ring Monitor Menu Items 


snooper. For further information on station status, refer to 
“All Stations Statistics in Numeric Format” later in this 
chapter. 


Number of stations that have transmitted in the current 
monitoring session. This number is equal to or greater than 
Maximum Inserted Stns. 


Average utilization of the network’s capacity. 
Total number of frames transmitted. 
Total number of bytes transmitted. 


Average size of transmitted frames (that is, total bytes 
divided by total frames). 


The following list explains the terms in the right column. All the statistics in this column 
pertain to the last second: 


Current Inserted Stns 


Active Stations 


Current Usage 
Current Frames 
Current Bytes 


Avg Frame Size 


Error Counts 


Number of inserted stations. 


Number of stations that have transmitted frames of any 
type. 


Utilization of the network’s capacity. 
Number of frames transmitted. 
Number of bytes transmitted. 


Average size of transmitted frames (that is, current bytes 
divided by current frames). 


The Error Counts column shows the overall condition of the network and the numbers of 


errors. 


Ring State 


The general condition of the network. The following explains the 
possible messages displayed for Ring State: 


“Beaconing” indicates that the network is inoperable. A network can 
be in the beaconing state because of a physical break in the token 
ring or a time-out during monitor contention. 


“Monitor Contention” indicates that the network is in the process of 
selecting a new active monitor. This happens when the current 
active monitor has not received its Ring Purge MAC frame within 
one second of its transmission. 


“No Receive Signal” indicates that the Token-Ring Monitor receives 
no signals from the network. This happens when the Token-Ring 
Monitor station is disconnected from the network. 


141 


Sniffer Advanced Token-Ring Network Monitor User’s Manual 


Oversized Frames 


Ring Purges 


Soft Error Reports 


“Operating Normally” indicates that the network is in normal 
operation. (That is, an active monitor is present, and a token is being 
circulated on the network.) 


“Removed from Ring” indicates that the Token-Ring Monitor is 
prevented from entering the token ring because the IBM LAN 
Manager program is not configured to allow a monitoring device to 
be present on the network. 


“Ring Purge” indicates that the active monitor has sent out a Ring 
Purge MAC frame because it detected that a token has been lost. 


“Not monitoring” indicates that the Token-Ring Monitor is not 
monitoring the network. 


Number of frames that exceed 4,608 bytes on a 4 Mb/s network or 
that exceed 18,432 bytes on a 16 Mb/s network. 


Number of times the active monitor purges any circulating 
information from the ring because it has not seen a free token or a 
good frame within 10 milliseconds. 


Number of intermittent errors counted and reported by the token- 
ring adapters on the network. There are different types of soft errors. 
For example, a line error indicates that there was an invalid 
character in a frame or token or that there was a checksum error ina 
frame; a lost frame error indicates that a station that transmitted a 
frame fails to receive the frame. 


For further information on soft errors and error recovery, refer to the TMS380 Adapter 
Chipset User’s Guide or Token-Ring Network, Architecture Reference. 


Timestamps 
Monitor Started 
Monitor Active 
First Activity 
Last Activity 


Network Active 
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Date and time the current monitoring session started. 
Length of the current monitoring session. 

Date and time the first frame was transmitted. 

Date and time the most recent frame was transmitted. 


Amount of time between the first and most recent frames 
transmitted. 


Token-Ring Monitor Menu Items 


Global Statistics in Graphic Format 


Figure 57 is an example of a Global Statistics view in the graphic format. 


LORAL STATISTICS 44444 (st 02 17:06:5 


Traffic Counts 
Maximum Inserted Stns 26 Current Inserted Stns 2 
| Total Stations 24 Active Stations 13 
| 9.07 % Current Usage 0.80 % | 
22, 087 Current Frames 46 | 
5, 808, 207 Current Bytes 4 030 | 
262 Avg Frame Size 87 


‘A—AMAAA—A—A- he 


b 6Disply 
Help Menus #options 


Figure 57. Global statistics (graphic view). 


i? Scale 10 Stop 
up down fidisplaygimoni to 


The top portion of the view displays traffic counts identical to those in the numeric view. 

The graph in the bottom portion shows absolute network usage (in percentage) over a 60- 
second period. The graph updates at one-second intervals, moving across the view from 

right to left. The current time and date display in the upper-right corner of the view. 


Recommendations 


The Token-Ring Monitor can display accurate statistics up to certain values. It displays 
“Ovrflw” instead of the numeric value when a statistic has exceeded the maximum value. 


The maximum value of Total Frames is 4,294,967,295; the maximum value of Total Bytes 
is 999,999,999,999. The maximum value of each type of error counts is 65,535. Reset the 
monitor immediately after “Ovrflw” appears. This way, you can examine the accurate 
statistics in the Global Statistics view for the current session. 
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This view provides a high-level view of current activity for a selected station. 


Options 

Stn The name of the station for which the Token-Ring Monitor displays 
statistics. If you press Enter after selecting this option, a station list 
appears. Choose a station from the list. 

Numeric Displays traffic statistics for the selected station as columns of numbers, 
including transmissions, receptions, and both (Figure 58). 

Graphic Displays traffic statistics for transmissions, receptions, or both, 


depending on the Class option you choose. The graph in the bottom 
portion shows either absolute or relative network usage by the station 
over a 60-second period (Figure 59). 


Single Station Statistics in Numeric Format 


Figure 58 is an example of the display for a single station. 


ABSOLUTE TRAFFIC STATISTICS-SINGLE STATIONt———————Oct_ 02 17:22:57 
Traffic TO and FROM Station 
n: File Server Current Usage 5.18 % 


s: Active Hon 6.53 % | 


6Disply QFreezefi0 Stopmmm 
Help Menus [options disp lay§imoni tora 


Figure 58. Single station statistics (numeric format). 


The top portion shows traffic counts for both transmissions and receptions for a selected 
station. The lower-left portion shows counts for transmissions; the lower-right portion 
shows counts for receptions. 


Token-Ring Monitor Menu Items 


The left column in the top portion displays the following types of general information: 


Station 


Last sent to 


Last rev from 


Name of the station for which statistics appear. 


Address or name of the station to which the most recent frame was 
transmitted. 


Address or name of the station from which the most recent frame was 
received. 


Traffic TO and FROM Station 


Current Usage 


Average Usage 


Total Frames 
Total Errors 
Total Bytes 
Avg Frame Size 
FROM Station 


Current Usage 


Average Usage 


Total Frames 
Total Errors 
Total Bytes 
Avg Frame Size 
Start Time 

End Time 


Elapsed 


TO Station 
Current Usage 


Average Usage 


Percentage of utilization in the last second for both transmissions 
and receptions. 


Average percentage of utilization for both transmissions and 
receptions in this monitoring session. 


Total number of frames transmitted and received. 
Total number of soft error report frames transmitted. 
Total number of bytes transmitted and received. 


Average size of frames transmitted and received. 


Percentage of network utilization for transmissions in the last 
second. 


Average percentage of utilization for transmissions in this 
monitoring session. 


Total number of frames transmitted. 

Total number of soft error reports transmitted. 

Total number of bytes transmitted. 

Average size of frames transmitted. 

Date and time the first frame was transmitted. 

Date and time the most recent frame was transmitted. 


Amount of time between the transmission of the first and most 
recent frames. 


Percentage of utilization for receptions in the last second. 


Average percentage of utilization for receptions in this monitoring 
session. 
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Total Frames Total number of frames received. 

Total Bytes Total number of bytes received. 

Avg Frame Size Average size of frames received. 

Start Time Date and time the first frame was received. 

End Time Date and time the most recent frame was received. 

Elapsed Amount of time between the first and most recent frames received. 


Single Station Statistics in Graphic Format 


Figure 59 is an example of the display for a single station in the graphic format. 


- i 


ABSOLUTE TRAFFIC STATISTICS-SINGLE STATION Oct. 02 17:31:24 
Traffic TO and FROM Station ‘ 
ent Usage 21.61 % 


i een 
Help loptions§ up down §idisplaygmonitor| | 


Figure 59. Single station statistics (graphic view). 


The statistics in the top portion of the graphic view are identical to those displayed in one 
of the portions in the numeric view, depending on the Class option you choose. 


For example, if you choose To for the Class option, the display does not include the 
address or name of the station to which the most recent frame was transmitted (the “Last 
sent to” field). The number of errors (the “Total Errors” field) is displayed only if Both or 
From is selected for Class. 


The graph in the bottom portion of the Single Station view (Figure 59) shows either 
absolute or relative network usage (in percentage) by the station over a 60-second period. 
The graph updates at one-second intervals, moving across the view from right to left. 


Token-Ring Monitor Menu Items 


If you select Both for the Class option, each bar in the graph is made up of two portions. 
The upper portion represents the reception statistics; the lower portion represents the 
transmission statistics. A color monitor displays reception statistics in yellow and 
transmission statistics in blue. 


Recommendations 


As with the global statistics, the Token-Ring Monitor can display accurate statistics for a 
single station up to certain values. If a statistic for both reception and transmission exceeds 
the maximum value, the Token-Ring Monitor displays “Ovrflw” instead of the numeric 
value. For example, if Total Frames in the Traffic TO and FROM Station column exceeds 
4,294,967,295, “Ovrflw” appears. 


However, if the number of the transmitted frames or received frames exceeds the 
maximum value, the Token-Ring Monitor does not display “Ovrflw.” In this case, the 
numeric value displayed is still inaccurate. 


It is recommended that if you display the numeric view, reset the monitor once “Ovrflw” 
is displayed. If you display the graphic view for transmission or reception traffic only, 
there is no warning about the overflow of the frame counts. In this case, it is important that 
you reset the monitor once “Ovrflw” is displayed for Total Frames in the Global Statistics 
view. When Total Frames overflows, it is possible that the frame counts for one or more 
stations are inaccurate. 
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Display All Stations 


This view shows statistics for each station across the network, sorted according to your 
specification. 


Options 


Numeric Displays statistics as columns of numbers, for up to 20 stations at a 
time. You can choose which statistics to display (see “All Stations 
Statistics in Numeric Format” later in this section), how to display 
them, and how to sort them (see the description of Sort by later in this 
section). 


Graphic Displays a graph and lists 10 stations at a time. Refer to “All Statistics 
in Graphic Format” later in this section for a description of the 
display.) 


Sort by Specifies the order in which the statistics are arranged and the key by 
which the statistics are sorted. The options available are as follows: 


Ascending displays statistics from the lowest to the highest, as 
defined by the sort key. 


Descending displays statistics from the highest to the lowest, as 
defined by the sort key. 


Name sorts the stations by their names. 


Partner’s name sorts the stations by the names of their partners. A 
station’s partner is the last station with which it communicated. 


Ring order sorts the stations according to the order of the stations on 
the token ring. When Ring order is selected, the active monitor is 
displayed first, followed by the standby monitors. The standby 
monitors are arranged in such order that each station is followed by 
its upstream neighbor. 


After the standby monitors, the rest of the stations are grouped by 
station status in this order: snooper, removed, remote, inactive, and 
group. Refer to “All Stations Statistics in Numeric Format” later in this 
section for more information on station status. 


The Token-Ring Monitor displays a warning message if it cannot 
determine the ring order. 


Frames sorts the stations by the number of frames transmitted, 
received, or both. 


Errors sorts the stations by the number of error frames transmitted. 


Bytes sorts the stations by the total number of bytes transmitted, 
received, or both. 
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Average size sorts the stations by the average size of the frames 
transmitted, received, or both. 


First activity sorts the stations by the date and time that the first frame 
was transmitted or received. 


Last activity sorts the stations by the date and time that the most 
recent frame was transmitted or received. 


Elapsed activity sorts the stations by the amount of time between the 
first and last activity. 


Active stns only _ Displays only stations that have sent or received traffic since the 
beginning of the current monitoring session. 


Inserted stns only Displays only stations whose station status is active monitor, standby 
monitor, or snooper. 


All Stations Statistics in Numeric Format 


The numeric display always includes the names of the stations, but you can specify the 
other types of statistics to be included in the display. The types are: Partner's name, 
Station status, Frames, Errors, Bytes, Average size, Network usage, First activity, Last 
activity, and Elapsed activity. 


For definitions of these terms except Station status and Network usage, refer to the 
description of Sort by earlier in this section. 


Station status refers to the status of the station on the network. The following is a list of 
different station statuses: 


Active monitor The station serves as the active monitor, which initiates the token 
transmission and provides the soft-error recover facility. 


Standby monitor The station serves as a standby monitor, which can detect failures in 
the active monitor and traffic disruptions on the network. A standby 
monitor may become the active monitor if the active monitor fails. 


Snooper The station is currently sending Trace Tool Present frames. (The 
Token-Ring Monitor’s station status is snooper; it sends out a Trace 
Tool Present frame every minute.) 


Removed The station was previously inserted but has left the ring. 

Remote The station is on a remote token-ring network. 

Inactive The station has never transmitted a frame. 

Group The address is not station-specific. For example, it is a broadcast 
address. 


Network usage shows the relative or absolute usage of the network in percentage.The 
percentage might fall in the range between 100 and 200 if the class of traffic is Both, 
because the Token-Ring Monitor counts each frame twice. 
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Figure 60 is an example of a numeric display showing the statistics for all stations. 


ABSOLUTE TRAFFIC STATISTICS TO AND FROM STATIONS———————ct 02 17:42:17 | 


Station Frames Errs Bytes Size %Usage 

1 File Server 276, 009 50 73,432 466 266 6.51 

2 Print Server 191, 194 56 45,520,130 238 4.03 

| 3 Denise Martin 19 580 0 18,011,413 919 1.59 
| 4 Mark Ellison 19 801 4 15,513,678 783 1.37 | 
| 5 Ed Hicks 19389 2 15,013,438 774 1.3 | 

| 6 Linus Stanwick 19, 206 3 14282561 743 1.26 

7 Steven Anderson 19, 264 15 9 802,593 508 0.87 

8 Villiam Griffith 19 582 8 6,804,908 37 0.60 

9 Tom Brown 19, 623 0 6,011,525 36 0.53 

10 Michael Harley 19 809 3 4914731 248 0.43 

11 Miles Russell 19 575 g 2,748,389 140 0.24 

12 Barbara Lemmon 19 565 g 2,707,797 138 0.24 

13 Bill Goodman 19 619 0 2,520,836 128 02 

14 Barney Ingram 20, 025 0 22020,0%7 110 0.19 

15 Ken Quinn 19, 201 2 22020008 115 0.19 

16 Alex Zwick 19 715 10 1,982,862 100 0.17 x 
17 Helene Milici 19 558 6 1,947,270 9 0.17 o 

18 George Stanley 19, 901 0 1,79%,588 90 Or | 
19 Jill Franz 20, 066 2 172,080 8 O14 e | 
| | 20 Robert Hayes 19.66 2 144160 73 O12) | 
a 
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Figure 60. Statistics for all stations (numeric view). 


All Stations Statistics in Graphic Format 


The categories of statistics in the graphic display cannot be changed. For example, you 
cannot specify that the names of the stations’ partners be displayed. 


The bottom portion displays absolute or relative network usage (in percentage) for up to 
10 stations at a time, sorted by the key you selected. 


The top portion shows statistics for the displayed stations as a graph, with transmissions, 
receptions, and both counts appearing in different colors or intensities. 
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Figure 61 is an example of a graphic display showing the statistics for all stations. 


hemmeaaie TRAFFIC STATISTICS TO AND FROM STATIONS--——————ctt 02 ses 


10 ddA A— AAA —§ A ‘AAAA—AAAA 


omnna 
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Legend: BOTH FROM TO 


1 File Server 61.15 % 6 Linus Stanwick 12.10 % 
2 Print Server 38.60 % 7 Steven Anderson 8.52 % 
3 Denise Martin 14.9 % 8 William Griffith 5.6% 
4 Mark Ellison 12.% % 9 Tom Brown 5.07 % 
5 Ed Hicks 12.40 % 10 Michael Harley 4.16 % 


Yore»— 
ieip MMMM tation ens ction up dom Bisplayfniter 
Help tationfistatio loptionsg up down idisplaygmonito 


Figure 61. Statistics for all stations (graphic view). 
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Display Frame Sizes 
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Shows how many frames fall into each predefined size category and what percentage of 
frames each size category comprises. Figure 62 is an example of the display on a 4 mb/s 
network. The size categories are different on a Token-Ring Monitor that is running at 16 
mb/s. 


Size Frames Percent 0 20 40 60 80 100 | 
cj nae 
0 0.00- 
0 0.00 - 
13.060 565 
168,770 21.02 —— 
1674 0 
110° 5454 — 
47, 165 5.87 |= 
19 230 2.390 -™ 
45, 686 5.69 = 
20, 329 2.53 |= 
0 0.00 - 
0 0.00 - 


D 6Disply OFreeze—i10 Stop 
Help Menus [options display—monitor 


Figure 62. Frame Sizes view. 


size Displays the size categories (in bytes) used to classify the frames. The 
minimum frame size is 17. The first size category is “Under 17”, which 
counts the number of fragments that are smaller than the minimum size. 


Frames Displays the total number of frames for each size category. 


Percent Displays the percentage of frames for each size category. The graph 
illustrates these percentages. 


Token-Ring Monitor Menu Items 


Display Routing Info 


Shows the number of frames routed to and from the local token-ring network. You can 
display the Routing Paths view or the Routing Lengths view. 


Routing Paths View 


Figure 63 is an example of the Routing Paths view. 


ROUTING | eo Oct 30 15:06: 
: 4,76 22.5% 
16,359 77.47% 


| non-transmitting 


| aie b 6Disply QFreezel 
| Help Menus foptions disp laygmonitor 


Figure 63. Routing Paths view. 


The first two lines of the display show the numbers and percentages of routed and non- 
routed frames. A frame’s source address indicates whether a frame is routed or non- 
routed. If the RII bit (bit 0 of byte 0 in the source address) is 0, the frame is non-routed. For 
further information on source addresses, refer to Token-Ring Network, Architecture 
Reference. 


The rest of the display breaks down the statistics further. It shows the numbers and 
percentages of routed frames between the local network and the remote networks. The 
box named “Local ring” contains the number and percentage of non-routed frames. The 
box named “Remote rings” contains the number and percentage of frames that pass 
through the local token-ring network from remote networks. 


Between the “Local ring” and “Remote rings” boxes are two types of statistics. “Frames to 
remote rings” shows the number and percentage of frames sent from the local network to 
a remote network. “Frames from remote rings” shows the number and percentage of 
routed frames that are destined for the local network. 
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The frames sent to “Other Routes” can be any of the following types: 


e Broadcast frames from the local or remote networks 
e Frames that are destined for a group address 


e Frames that have been sent to non-transmitting stations. 
Routing Lengths View 


Figure 64 shows an example of the Routing Length view. 
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Figure 64. Routing Lengths view. 


The display categorizes the frames according to the length of the route. The length is the 
number of token-ring bridges that a frame has traversed. In the display, the length can 
range from 0 to over 12. 


Ifa frame’s routing length is 0, it means that the frame includes the Routing Information 
field, but the Length Bits in the frame are 0. For further information on the Routing 
Information field and Length Bits, refer to Token-Ring Network, Architecture Reference. 


The category “All Routes” represents the all-routes broadcast frames. These frames are 
sent to all token rings that are interconnected with the local network by bridges. If the 
number of bridges a frame has traversed cannot be determined, and the frame has a 
destination or source address that does not exist on the local network, the frame is counted 
in the “Other” category. 


The percentages in the display are the percentages of all routed frames. The graph 
illustrates these percentages. 


Token-Ring Monitor Menu Items 


Display SAP Protocol Types 


Shows a distribution of protocol types used on the network. The options Bytes and Frames 
determine whether the statistics are displayed in bytes or frames. The Token-Ring Monitor 
reads the STARTUP.TRT file for the SAP values. 


Figure 65 is an example of the Protocol Types (SAPs) view. 


PROTOCOL TYPES (SAPS) ——Oct 03 15:20 " 
Ap Bytes Total 0 20 40 60 80 100 
3546403 25 — 
2,016, 468 7.16 -== 
610 1 = 
21,410 0.96-m 
58H 132 
2 278, 766 8.00 -_=— 
0 0.00 - 
133, 866 0.47 == 
D1, 949 0.89 -™ 
1413, 082 0.40 -™ 
63, 234 0.22 8 
1, 860, 640 6.60 -=™ 
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Figure 65. Protocol Types (SAPs) view. 


The following explains the terms used in the display: 


SAP Protocol type to which the frame being counted belongs. 

Bytes / Frames Number of bytes or frames that fall into a particular protocol 
category. 

%Total Percentage of frames or bytes of a particular protocol type. The 


graph illustrates these percentages. 


If an LLC frame encapsulates the Ethertype value in the SNAP (Sub-Network Access 
Protocol) header, the Token-Ring Monitor treats the frame as a frame that uses SNAP 
regardless of the Ethertype. For example, if the Token-Ring Monitor detects an LLC frame 
that encapsulates the Ethertype IP in the SNAP header, it increases the byte or frame count 
under SNAP, not IP, in the Protocol Types (SAPs) view. 
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You are allowed to specify multiple values for a protocol type. For example, 
STARTUP.TRT can contain the following entries: 


sap “SNA” = 04 
sap “SNA” = 08 


When the Token-Ring Monitor displays the SAP protocol types, there is one entry for 
SNA. The count under this entry includes all the frames that have the SAP value equal to 
04 or 08. 


Display Alarm Log 


Lists up to 200 alarms generated in the current monitoring session that have not been 
cleared. You can also acknowledge by pressing F3, and clear alarms by pressing F4 from 
the Alarm Log view. You can log this information to a printer or to disk with the Alarm 
menu item. 


Figure 66 is an example of the Alarm Log view. 


a. ae er 


| Priority Time Source Type/Description k 


2 Warning :12:52 File Server 5 or more error reports 
3 Warning 15:13:43 Print Server 5 or more error reports 
4 Warning 15:14:11 William Griffith 5 or more error reports 
5 Warning 15:24:26 Steven Anderson 5 or more error reports 
6 Warning 15:24:55 Alex Zwick 5 or more error reports 


ay. b 6Disply 0 Stop 
Help alarm § alarm § Menus options; moni tora 


Figure 66. Alarm Log view. 


The following list explains the fields in the Alarm Log view: 


Priority Priority level of the network event that triggered the alarm. 
Time Time and date the event occurred. 
Source Name of the station that triggered the alarm. 


Type/Description Type of event that triggered the alarm. 


Se ee eee 
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Ack Whether the alarm has been acknowledged (indicated by a V mark). 


Display Global History 


Displays a history of activity for the entire network at intervals you determine. 


Options 
Numeric Displays history statistics as columns of numbers. 
Graphic Displays the usage of the network in a graph. 


Global History Statistics in Numeric Format 


Figure 67 is an example of the Global History Statistics view. 


LOBAL HISTORY STATISTICS-—————————————Ooct 26 16:36:51 


| Time Frames Errs Bytes Size ZUsage 
| 2A Oct 26 16:36:43 17, 468 12 4,533,409 29 7.7 
20 16:34:43 28, 984 3 7,200,903 249 12.38] | 
19 16:32:43 24, 326 6 5,747,665 236 9.86 | | 
| 18 16:30:43 22, 886 15 5,740,709 20 9.83] | 
| 17 16:28:43 24, 973 3 6,687,986 267 11.43 
16 16:26:43 2B, 069 15 6,382,022 24 10.92 
15 16:24:43 26, 788 B 6,407,011 239 10.99 
14 16:22:43 2B, 063 1 6,571,604 262 11.24 
13 16:20:43 DB, 369 13 6,205,828 244 10.63 
12 16:18:43 24, 168 12 6,140.575 24 10.54 
a 16:16:43 26, 289 10 6,781,064 2/7 11.60 
10 16:14:43 26, 366 g 6,715,119 24 11.49 
g 16:12:43 26, 969 13 6,152,979 228 10.56 
| 8 16:10:43 26, 091 7 6,511,209 249 11.15 K | 
7 16:08:43 D2 3 5513472 243 9.450. 
6 16:06:43 4,378 6 6,595,404 20 11.30r | 
| 5 16:04:43 24, 485 g 6,095,834 248 10.44e 
| 4 16:02:43 2, 415 14 5,471,446 244 93 y 


8 Vie 6Disply 
Help earlier later] Menus fMoptions moni tor 


Figure 67. Global history statistics (numeric view). 


The leftmost column of numbers identifies the interval number, with the most recently 
recorded interval at the top of the screen. 


The following list explains the various fields in the numeric Global History Statistics view: 


Time Displays the date and time of each interval. The date is not displayed if it is 
the same as the one above it. 

Frames Displays the number of frames recorded for each interval. 

Errs Displays the number of errors recorded for each interval. 

Bytes Displays the number of bytes recorded for each interval. 
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Size Displays the average size of the frames recorded for each interval. 
% Usage Displays the absolute network usage (in percentage) for each interval. 
Global History Statistics in Graphic Format 


Figure 68 is an example of the graphic Global History Statistics view. 
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2L Oct 26 16:36:43 t6 
20 16:34:43 12.38 
19 16:32:43 9.86 
18 16:30:43 9.83 
17 16:28:43 11.43 
16 16:26:43 10.92 
15 16:24:43 10.99 
14 16:22:43 11.24 
13 16:20:43 10.63 
12 16:18:43 10.51 
slat 16:16:43 11.60 
10 16:14:43 11.49 
g 16:12:43 10.56 
8 16:10:43 11.15 M 
7 16:08:43 9.45 0 | 
6 16:06:43 11.30 aa 
5 16:04:43 10. 44 e | 
4 16:02:43 9.38 J | 


i 3 Views4 Vie Pens 6Disply—/ Scalegs Scale 10 Stop 
Help earlier§ later loptionsg up down moni tor 


Figure 68. Global history statistics (graphic view). 


The graphic display contains only the time and the network usage, which appear the same 
as those in the numeric display. The graph illustrates the percentages of network usage. 


Display Station History 


Displays a history of activity for a selected station or address at intervals you determine. 
The title identifies the station as well as whether statistics represent transmissions, 
receptions, or both, and whether they show absolute or relative network usage. If you do 
not select a station, these statistics are collected for the default address (Broadcast). 


Options 
Numeric Displays station history statistics as columns of numbers. 
Graphic Displays a station’s history statistics in a graph. 


Station History Statistics in Numeric Format 


Figure 69 is an example of the history statistics display for a station named “File Server” 
in numeric format. 
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Time Frames Errs Bytes Size Usage 
2 Oct 26 16:38:43 3,825 0 931,303 243 1.59 
at 16:36:43 10,513 3 2,962,100 281 5.05 
20 16:34:43 16, 919 3 4 437,814 262 7.50 | | 
19 16:32:43 14, 263 3 3,201,840 224 5.50] | 
18 16:30:43 13, 286 il 3,452,364 29 5.90 
17 16:28:43 14,555 0 4179546 287 7.13 
16 16:26:43 14, 674 1 3,930,080 268 6.73 
15 16:24:43 15, 5 3,712,781 240 6.47 
14 16:22:43 14,594 7 3,967,243 273 6.81 
13 16:20:43 14 588 0 3,778,333 29 6.46 
12 16:18:43 14 230 3 3,814 111 268 6.52 
1 16:16:43 15, 302 4 4 305,063 28 = 7.50 
10 16:14:43 15, 524 0 4,036,815 260 699 
9 16:12:43 15, 719 4 3,773,153 240 6.474x 
8 16:10:43 15, 4 3 3,941,120 28 6.740 
a 16:08:43 13,172 1 3,470,480 263 5.93r 
6 16:06:43 15, 284 6 4,070,686 266 6%e) 
5 16:04:43 14,3 4 3,710 770 29 6% 1 


\ 


| 
| 


3 Views4 Viewgo ODisply 0 Stop 
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Figure 69. Station statistics for "File Server" (numeric view). 


The leftmost column consists of the interval numbers, with the most recently recorded 
interval at the top of the column. 


Time 
Frames 
Errs 
Bytes 
Size 


% Usage 


The date and time of each interval. 

The number of frames recorded for each interval. 

The number of errors recorded for each interval. 

The number of bytes recorded for each interval. 

The average size of the frames recorded for each interval. 


The percentage of absolute or relative network usage for each interval. 
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Station History Statistics in Graphic Format 


Figure 70 is an example of the station history display for a station named “File Server” in 
graphic format. 


ABSOLUTE HISTORY STATISTICS TO AND FROM File Server-—————Oot 26 ies bt 
* z - ; P 8 ; 


Time ‘sage 0 2 4 6 10 
| 2 Oct 26 16:38:43 1 | 
at 16:36:43 5.0 | 
20 16:34:43 7.59 | 
19 16:32:43 5.50 | 
18 16:30:43 5.90 
17 16:28:43 7.13 
16 16:26:43 6.73 
15 16:24:43 6.47 
14 16:22:43 6.81 
13 16:20:43 6.46 
12 16:18:43 6.52 
1 16:16:43 £00. | 
10 16:14:43 6.00 | 
g 16:12:43 6.47 | M 
8 16:10:43 6.74 | ) 
| 7 16:08:43 5.93 | r 
| 6 16:06:43 6.96 | e | 
5 16:04:43 6:5: | 1 
re rnp 


F Hel | 3 Viewed Views 6Displyg/ Scale—i8 Scale 
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Figure 70. Station statistics for "File Server" (graphic view). 


a 


The leftmost column consists of the interval numbers, with the most recently recorded 
interval at the top of the column. 


Time Date and time of each interval. 


Yo Usage Percentage of absolute or relative network usage for each interval. The 
graph illustrates the percentages. 
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Alarm 


Token-Ring Monitor Menu Items 


Clears alarms from the alarm buffer automatically, sets alarm thresholds, and determines 
where to send the alarm log. 


Options 


Edit 


Auto clear 


Thresholds 


Displays the Manage Station Information view, in which you can edit 
station information. For further information on station information, refer to 
“Manage Stations” later in this chapter. 


Sets an interval (1 minute to 99 hours) at which the Token-Ring Monitor 
automatically clears each alarm to make room in the alarm buffer. To make 
sure alarms are not lost, use Log to for printing out the alarms or storing to 
disk. To turn Auto clear off, choose 0. 


Specifies alarm thresholds. There are two types of thresholds: Global and 
Station defaults. 


Global determines the types of network events that cause alarms. Options 
for Global are described below: 


If Unknown station is selected (with a V mark preceding the option), a 
station that has not been named triggers an alarm. 


Specify other causes of alarms with the Errors, Usage, Broadcast, and Idle 
options. Except for the Idle option, you can define an interval (5 seconds to 
60 minutes) during which the Token-Ring Monitor determines whether a 
threshold has been exceeded. After each interval, the count resets to 0. 


Errors defines the number (1 to 65,535) of soft error frames on the network 
that triggers an alarm. The default number is 20; the default interval is 30 
seconds. 


Usage defines the percentage (1 to 100%) of absolute network usage that 
triggers an alarm. The default percentage is 25%; the default interval is 5 
seconds. 


Broadcast specifies the number of frames that can be sent to the broadcast 
address before the Token-Ring Monitor generates an alarm. The default 
number is 100; the default interval is 5 seconds. 


Idle specifies the length of time (1 to 120 minutes) the network can be 
inactive before the Token-Ring Monitor generates an alarm. The default 
length of time is 15 minutes. 


Station defaults assigns the default threshold settings to new stations as 
they are detected on the network. The thresholds are described below: 


Errors defines the number (1 to 65,535) of soft error frames a station can 
transmit before triggering an alarm. The default number is 5. 


No response determines when the Token-Ring Monitor generates a no- 
response alarm. The default setting of No response is 5 seconds. The 


161 


Sniffer Advanced Token-Ring Network Monitor User’s Manual 


162 


Log to 


Token-Ring Monitor does not generate a no-response alarm each time the 
specified number of seconds has elapsed since a station received a frame. 
Instead, it makes sure that the station it generates the alarm for has been 
receiving but not transmitting. For example, if No response is 5 seconds, 
the Token-Ring Monitor generates the alarm when either of the following 
conditions occurs: 


e Asstation’s last reception happened at least 5 seconds after the last 
transmission, and it has received 3 frames since the last transmission. 


e Astation’s last reception happened at least 5 seconds after the last 
transmission, and 5 seconds has elapsed since the last reception. 


Idle defines the length of time (1 to 120 minutes) the station can go without 
transmitting before triggering an alarm. By default, this alarm is disabled. 
That is, the Token-Ring Monitor does not generate an alarm regardless of 
how long a station has been idle. 


Usage defines the percentage of relative network traffic (1 to 100%) the 
station can generate before triggering an alarm. The default is 25%. 


Priority defines the importance of alarms for a given station. The priority 
levels are Inform, Warning, Minor, Major, and Critical. 


Specifies where to send the alarm log. You can select either or both of the 
following: 


Printer, which sends the alarm log to the specified printer and specifies the 
page size. 


File, which sends the alarm log to a disk file (ALARM.LOG). This option 
also determines whether the Token-Ring Monitor appends the current 
alarm log to the previous log file or whether it clears the log file each time 
it starts monitoring. A V mark preceding the Clear alarm file option 
indicates that the file is cleared at the beginning of each monitoring session. 


Report 


Token-Ring Monitor Menu Items 


Generates reports based on report scripts. You can print the resulting reports and save 
them as files, in either standard or CSV (comma-separated-values) format. The Report 
Script Editor view lets you modify report scripts to customize reports to your needs. 


Options 


Load 


Loads an existing report script which you can use to generate a report or 
edit before generating a report. (The Token-Ring Monitor looks for report 
scripts in the C:\CAPTURE\TRREPT directory). 


The Token-Ring Monitor comes with the following report scripts: 


ERRORS provides statistics for the 10 stations that transmitted the most 
frames with errors during the most recent monitoring session. A station 
must have transmitted at least five frames with errors to be included in the 
report. 


FRAMSIZE shows the frame size distribution. The statistics provided 
include the number and percentage of frames that fall in each frame size 
category. A graph illustrates the percentages. 


HISTORY shows the absolute network usage in percentages for all the 
history intervals. 


LISTENRS provides statistics for the 10 stations that received the most 
traffic during the most recent monitoring session. 


RINGORDR provides statistics for the relative usage of the network by all 
stations. The stations are sorted by ring order. For further information on 
ring order, refer to “Display All Stations” earlier in this chapter. 


ROUTELEN provides statistics for different route lengths. The report 
shows the number and percentage of frames of each route length. The 
information in the report is the same as the Route Lengths view. 


ROUTEPTH provides statistics for route path distribution. The report 
shows the number and percentage of frames for each type of route path. In 
the display, “Loc” represents for local; “Rem” represents remote; and 
“Other” represents other routes. For further information on route paths, 
refer to “Display Routing Info” earlier in this chapter. 


SAPS provides statistics for the SAP protocol type distribution. The report 
shows the number of bytes that belong to each SAP protocol type and the 
percentage of network usage by these bytes. 


TALKERS provides statistics for the 10 stations that transmitted the most 
traffic during the most recent monitoring session. 


USERLIST lists the physical addresses and names of all stations, sorted in 
descending order by name. 
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Edit 


USERS provides transmit and receive statistics for all stations, sorted in 
ascending order by name. 


USERSCSV provides the same information as the USERS report, but in a 
delimited format that allows you to import the information into 
spreadsheets and other applications. 


(For more information on these reports, see “Token-Ring Monitor Sample 
Reports: An Overview,” in Chapter 7.) 


Displays Report Script Editor view, which contains the last report script 
loaded and the function keys with which you modify the script. Refer to 
“Report Script Editor View” later in this chapter for further information on 
how to use the function keys. 


The Edit option also specifies how the statistics are sorted and what 
statistics are to be included in an existing report script. 


The following are the various options by which a report sorts the statistics: 
To refers to the frames the station receives. 

From refers the frames the station sends. 

Both refers to the frames the station sends and receives. 

Ascending specifies that the stations be displayed in ascending order. 
Descending specifies that the stations be displayed in descending order. 
Name is the stations’ names. 


Partner's name is the names of the stations’ partners. A station’s partner is 
the station that it communicated with most recently. 


Ring order is the order the stations are inserted in to the network. Refer to 
“Display All Stations” for information on ring order. 


Frames is the total number of frames. 

Errors is the total number of soft error frames. 

Bytes is the total number of bytes. 

Average size is the average frame size. 

First activity is the time when the stations first send or receive traffic. 
Last activity is the time when the stations last send or receive traffic. 
Elapsed activity is the amount of time between the first and last activity. 
Address is the stations’ addresses. 


The following describes the options that determine what types of statistics 
are to be included in a report: 
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Active stns only specifies that a station is included in a report only if it has 
sent or received a frame, depending on how the stations are sorted. For 
example, if they are sorted by the frames received (when the To option is 
selected), a station is considered active if it has received traffic. 


Inserted stns only specifies that a station is included ina report only if it is 
connected to the local network. That is, the station status of the station must 
be active monitor, standby monitor, or snooper. 


Filter 1 and Filter 2 determine whether the Token-Ring Monitor uses these 
filters when deciding whether it should include a station in the report. How 
the filters interact with each other depends on the AND and OR options. If 
AND is selected, the Token-Ring Monitor includes only the stations 
fulfilling the requirements of both filters; if OR is selected, it includes the 
stations that meet the requirements defined by either filter. 


For examples that illustrate the filters’ interaction, refer to “Creating or 
Modifying a Report Script” and “Recommendations on Report Editing” in 
Chapter 8. 


The To, From, and Both options associated with the filters determine 
whether the stations are to be filtered according to the number of frames 
received, sent, or both, respectively. 


Other options associated with the filters are described below. Each option 
defines a range of values. 


Sort position is to the position of the station in the report. The permissible 
range is 1 through 1,024. For example, if you specify that the minimum is 1 
and maximum is 20, the top 20 stations are included in the report. 


Name is the station’s name. It specifies the alphabetical range to which the 
station’s name must belong if the station is to be included in the report. The 
minimum value is “” and the maximum is “~~~~~~~~~~~~~~~~ ” Thatis, 
the minimum or maximum value can be up to 16 characters. For example, 
you can define “bb” as the minimum value and “kk” as the maximum. Ifa 
station’s name is bobby, it fulfils the requirement of the filter. If a station’s 
name is kristen, it is outside the specified range and the station will not be 
included in the report. Numerals are considered smaller than letters. For 
example, you can define the minimum to be “123” and maximum to be 
“abc.” The name strings are case-sensitive; lowercase is smaller than 
uppercase. For example, “abc” is smaller than “ABC,” and “C” is smaller 
than “z.” 


Partner's name is the name of the station with which a station 
communicated most recently. It specifies the alphabetical range to which 
the name of the station’s partner must belong if the station is to be included 
in the report. The rules for specifying the alphabetical range are the same 
as those for Name. 


Frames refers to the total number of frames. The permissible range is 0 
through 4,294,967,295. 
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Save 


Clear 


Print 


Errors refers to the number of frames with errors. The permissible range is 
0 through 65,535. 


Bytes refers to the number of bytes. The permissible range is 0 through 
999,999,099 ,999, 


Average size refers to the average frame size. The permissible range is 17 
through 18,432. 


First activity refers to the date and time when the first activity takes place. 
The minimum time is 0 days; the maximum time is 49 days 17:02:47.295. A 
station is included only if its first activity happened in the time period 
specified. For example, suppose the monitoring session started at 1 p.m. If 
you specify that the minimum value of First activity is 2 hours, and that the 
maximum value is 7 hours, a station is included in the report only if its first 
activity happens between 3 p.m and 8 p.m. 


Last activity refers to the date and time when the last activity takes place. 
It has the same permissible range as First activity. 


Elapsed activity refers to the time between the first and last activity. It has 
the same permissible range as First activity. For example, if you specify 
minimum value to be 0 and maximum value to be 2 days, only the stations 
whose first and last activities happened within 2 days meet the 
requirement of the filter. 


Address refers to the station’s address. The permissible range is 
000000000000 through FFFFFFFFFFFF. 


Absolute usage refers to the percentage of absolute network usage by the 
station. The permissible range is 0 through 100%. For example, if you 
specify minimum to be 10% and maximum 100%, only the stations whose 
traffic accounts for at least 10% of the network capacity meet the 
requirement of the filter. 


Relative usage refers to the percentage of relative network usage by the 
station. The permissible range is 0 through 100%. For example, if you 
specify minimum to be 10% and maximum 100 percent, only the stations 
whose traffic accounts for at least 10% of the network traffic meet the 
requirement of the filter. 


Saves a report script you created or modified. The report script must be 
stored in the C:\CAPTURE\TRREPT directory. 


Erases the contents of the report editor. 
Prints the report based on the report script that has been loaded. 
The Screen option displays the report on the screen. 


The Device COM1, Device COM2, Device LPT1, Device LPT2, Device 
LPT3, and Device LPT4 options specify the I/O port used for printing the 
report. If you send the report to a printer, you can specify the number of 
lines per page. The default is 58. 
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The File option saves the report to disk. You can select the Delimited 
format option, which removes all embedded commas in the report fields. 
By default, it is not selected. 


Auto print Prints out the report at each interval. The Token-Ring Monitor must be 
running in the foreground for Auto print to function. The following 
describes the options: 


Report specifies the file to be printed. 


Start time specifies when the first report should be printed. For example, if 
Start time is set to 08:00, and the current time is 2 p.m., the Token-Ring 
Monitor will print the first report at 8 a.m. tomorrow. To disable this 
function, specify 00:00. By default, Start time is disabled. 


Interval determines how often the Token-Ring Monitor prints a report. 
Specify a time between 1 minute and 24 hours. The default value is 1 hour. 


Print to device specifies the I/O port the Token-Ring Monitor uses to print 
out the file. You can specify the number of lines per page. The default is 58; 
selecting 0 disables page breaks. 


Print to disk specifies that the Token-Ring Monitor print the report toa file 
on the disk. If Single file is selected, all reports are appended to one file. 
The filename is ARYYMMDD.RPT (YYMMDD represents the year, month, 
and day). If Multiple files is selected, each report is printed to a separate 
file. The filename for each report is ARMMDDNN.RPT (MMDD represents 
the month and day, and NN represents the number of the report). You can 
print reports to up to 99 files. 


Restart monitor determines whether the Token-Ring Monitor starts a new 
monitoring session once it printed out a report. 


By default, Print to disk, Multiple files, and Restart monitor are not 
selected. 


Report Script Editor View 


The Report Script Editor view (invoked by Edit under Report on the main menu) lets you 
modify the last report script that was loaded. Its functions are accessible through special 
function keys. These keys are described below: 


F2 (Insert field) Displays a list of fields you can include in the report. When you select a 
field, the Token-Ring Monitor inserts a code into the script. Whenever 
you preview, print, or save a report based on this script, the Token-Ring 
Monitor inserts the current statistics that the code represents. Appendix 
C provides information on the report fields. 


F3 (Insert line) Inserts a blank line into the report script. 
F4 (Delete line) Deletes the line that contains the cursor from the report script. 


F6 (Edit options) Provides the Load, Save, Clear, Print, and Auto print options. These 
options are also available when you select Report from the main menu. 


i 


167 


Sniffer Advanced Token-Ring Network Monitor User’s Manual 


168 


F7 (Chars) 


In addition, the Report Settings option specifies how the statistics are 
sorted, whether only active stations are included, whether only inserted 
stations are included, and how the filters are used. Report Setting 
performs the same function as Edit under Report on the main menu. 


Lists the special characters you can insert in a report script. 


F8 (Repeat char) Repeats special characters for continuous lines or borders. 


F9 (Screen test) 


Provides a preview of the current report on screen. 


Token-Ring Monitor Menu Items 


Manage Stations 


Displays and edits station information such as station names and threshold settings. 


Options 

Edit Displays the Manage Station Information view. This view is also 
generated by Edit under Alarm on the main menu. Refer to 
“Manage Station Information View” later in this section for further 
information on the view. 

Reset thresholds Resets all station alarm thresholds to the default settings specified 
by the current station default thresholds. 

Probe for names Tries to assign names automatically using the NetBIOS remote 


status command. To use this option, you must have a second 
network card that is running NetBIOS. In addition, a responding 
station must be active and running the NetBIOS software. 


Manage Station Information View 


Figure 71 is an example of the Manage Station Information view. 


AGE STATION INFORMATION 


| Address Name Errors No Rsp Idle Usage Priority 
| 0000004h0652 Alex Zwick vs 5 Off Bs Warning 
Q000004K0303 Anthony Serrao 2 5 >> OF 2 Warning 
0000004E3400 Barbara Lemmon 25) 5 OEE 2 Warning 
0000004E3105 Barney Ingram 5 OF 2 Warning 
0000004E7256 Bill Goodman 2 Bp OFF 2 Warning 
| ene 004E5200 David Brooks 2 B OFF os) Warning 
a ise Martin Wa) 5 Ot 2 i 
25 5 Off 2 
ley 25 5 Off 2 
Milici n2) 5 {OFF 2 
0000004 7506 ayton 25 5 ORE 5 
QO00004E3249 James Wylie 25 5 ORE 2 | 
Q000004E2301 Jill Franz 25 5 Off 5 
00000040654 Ken Gul mn 25 5.» Of 2 | 
} 25 Boe ORF 25 | 
25 5 ff 25 
2 5 OF os) 
is 2 BOE 25 Warning 
tse T and iF then oan =<. 
i 2 Apply 4Deletegi Edit 
Help default station§| Menus Potions iedine 


Figure 71. Manage Station Information view. 


To edit a station’s information, use the cursor to highlight the corresponding entry. You 
can also type the first letter of the station’s name to move to the entry. Press Enter, and a 
dialog box appears, which allows you to change the following types of information: 
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Name 


Errors 


No response 


Idle 


% Usage 


Priority 


The station name assigned to an address. The name can contain up 
to 16 printable ASCII characters. 


The number of soft error frames (1 to 65535) a station can transmit 
before triggering an alarm. 


How long a station can receive frames (broadcast frames excluded) 
without responding before triggering an alarm. Any value from 1 to 
7 seconds is allowed. 


The length of time (1 to 120 minutes) the station can go without 
transmitting before triggering an alarm. 


The percentage of network traffic (1 to 100%) the station can 
generate before triggering an alarm. 


The importance of a station’s alarms. This includes Inform, 
Warning, Minor, Major, or Critical. 


Alternatively, you can use the function keys to edit the station information as described 


below: 
F2 (Delete station) 


F4 (Apply default) 


F7 (Thres options) 


Removes the station from the Token-Ring Monitor data files. 


Changes the threshold settings to the defaults. Specify the defaults 
with Alarm on the main menu. Refer to “Alarms” earlier in this 
chapter for further information on setting station default threshold 
settings. 


Displays the threshold options, which are the same options 
displayed by the Thresholds options under Alarm on the main 
menu. 


Token-Ring Monitor Menu Items 


Options 


Exit 


Enables or disables the audible alarms, sets the audible alarm threshold, and selects the 


network speed. 
Options 


Audible alarms 


4 Mb/s or 16 Mb/s 


If selected, an alarm causes an audible warning in the form of a 
series of beeps. A V mark before this option indicates that it has been 
selected. 


You can decide the type of alarm that generates an audible warning. 
Select the Priority option and press Enter. A list appears, showing 
the different types of alarms in ascending order of importance. For 
example, if you select Major, an alarm with a priority lower than 
major does not generate an audible warning; you hear the warning 
only when major or critical alarms occur. 


By default, Audible alarms is enabled, and Priority is Warning. 


The network speed is 4 Mb/s or 16 Mb/s per second. Be sure that the 
setting is the correct data rate for the network before you start a 
monitor session; an incorrect data rate can cause the network to be 
inoperable. The default speed is 4 Mb/s. 


Terminates the TRMON application and redisplays the Sniffer analyzer’s Main selection 


menu. 


Although you can continue to monitor in the background after you terminate the TRMON 
application, you cannot log alarms, clear the alarm log, control the audible alarm 
indicators, or print reports automatically. 


Upon exit, the Token-Ring Monitor writes the following files: STARTUP.TRB, 
STARTUP.TRA, and STARTUP.TRD. 
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Error and Warning Messages 


Appendix A. Error and Warning Messages 


This appendix lists the Token-Ring Monitor’s error and warning messages alphabetically. 
It explains each message and describes the action you should take when the message 
appears. 


Token-Ring Monitor Error Messages 
An error was encountered while loading the report script. 
Appears when you try to load an invalid report script file. Check your script and reload. 
Automatic report generation failed. 


Appears when the Token-Ring Monitor tries to print a report automatically but the report 
script is corrupted. Check the report script file, edit it if necessary, and load it before you 
regenerate the report. 


Automatic report generation failed. Couldn't open report file. 


Appears when the Token-Ring Monitor tries to print a report automatically but there are 
problems with the destination disk (for example, the directory structure is damaged). 
Make sure that your disk is operating properly and that the report scripts are stored under 
the C:\CAPTURE\TRREPT directory. 


Automatic report generation failed. Couldn't sort stations. 


Appears when the report to be printed is sorted by ring order but the Token-Ring Monitor 
cannot determine the ring order. This happens when the actual number of stations on the 
network exceeds the maximum number of stations you specified within the Configuration 
Options view. If your PC has enough memory, increase the value of Maximum Stations 
so that the Token-Ring Monitor can monitor all the stations on the token ring. 


Automatic report generation failed. Disk full. 


Appears when the Token-Ring Monitor tries to print a report automatically to the disk but 
the disk is full. Remove unnecessary files from the disk to make room for the reports. 


Automatic report generation failed. Report script not found. 


Appears when the Token-Ring Monitor tries to print a report automatically but cannot 
find the report script that the report should be based on. Check to be sure that the script is 
stored in the C:\CAPTURE\TRREPT directory. 


Automatic report generation failed to restart monitoring. 


Appears if the Token-Ring Monitor fails to restart monitoring after generating a report 
automatically. Check to see whether the hardware configuration is correct. If the Token- 
Ring Monitor still cannot start monitoring, contact Network General for help. 


Automatic report generation failed to restore report script. 


Appears if the Token-Ring Monitor cannot restore the report script after generating a 
report automatically. The changes that you have made to the script with the script editor 
are lost. Contact Network General for help if this happens. 
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Can’t concatenate fields. 


Appears in the Report Script Editor view if you try to place two fields on the same line 
without any text characters between them. Place at least one text character between any 
two fields. 


Couldn't generate a NetWare echo test. 


Appears when the Token-Ring Monitor cannot communicate with the NetWare stack. 
Check to make sure that one of the network interface cards in the PC is loaded with the 
NetWare stack. 


Couldn’t open file. 


Usually indicates that you typed the file name incorrectly. Try typing the name again. If 
you cannot open any files, check the FILES= setting in the DOS file, CONFIG.SYS, increase 
the number, and reboot. 


Couldn’t save station information. 


Appears if the disk is full. Make room by deleting other files that may not be essential, 
such as old history logs. 


Fatal Error: Unable to determine the monitor state! Re-boot the system and configure 
the monitor again. If the problem persists, contact Technical Support. 


Appears when the Sniffer analyzer fails to determine the state of the Token-Ring Monitor. 
Reboot the PC and display the Token-Ring Monitor Selection menu. Configure the 
monitor again. Contact Network General if the same message appears the next time you 
try to start the monitor. 


Fatal Error: Unable to load the monitor configurator! If the problem persists, contact 
Technical Support. 


Appears when the PC fails to load the configuration program to memory. Select the 
Configure Token-Ring Monitor option on the Token-Ring Monitor Selection menu again. 
If the same message appears, contact Network General. 


Fatal Error: Unable to load the monitor demo! Re-boot the system and configure the 
monitor again. If the problem persists, contact Technical Support. 


Appears when the PC fails to load the demonstration program to memory. Reboot the PC 
and display the Token-Ring Monitor Selection menu. Configure the Token-Ring Monitor 
again. Contact Network General if the same message appears the next time you try to start 
the demonstration program. 


Fatal Error: Unable to load the monitor! Re-boot the system and configure the monitor 
again. If the problem persists, contact Technical Support. 


Appears when the PC fails to load TRMONDRV to memory. Reboot the PC and display 
the Token-Ring Monitor Selection menu. Configure the Token-Ring Monitor again. 
Contact Network General if the same message appears the next time you try to start the 
monitor. 
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Fatal Error: Unable to unload the monitor from memory. Re-boot the system and 
configure the monitor again. If the problem persists, contact Technical Support. 


Appears when the PC fails to remove TRMONDRV from memory. Reboot the PC and 
display the Token-Ring Monitor Selection menu. Configure the Token-Ring Monitor 
again. Contact Network General if the same message appears again. 


Field too long. 


Appears in the Report Script Editor view when the end of the field you want to include 
reaches past the end of a line (column 80). Try positioning the cursor farther to the left 
before placing the field. 


Help file not found. 


Token-Ring Monitor could not find the TRMON.HLP file in the C:\TRSNIFF directory. 
Copy this file from the Token-Ring Monitor diskette if you received the software in an 
update. 


Network card not responding. 


Indicates a problem with programming the network interface card. This message can 
result from incorrectly installing the Token-Ring Monitor to the Sniffer analyzer or froma 
defective network interface card. Try the installation procedure again. If the problem 
persists, call your dealer for technical support. 


Network card set to the wrong ring speed. 


Appears when the network interface card in the Series 300 or Series 500 Sniffer analyzer is 
set to a network speed that is different from the speed you specified with Option, and the 
Token-Ring Monitor tries to transmit to the network during a transmit timer or station 
test. Change the hardware setting to match the software setting. 


No alarms to process. 


Appears if you try to acknowledge or clear an alarm in the Alarm Log view when there 
are no alarms in the alarm buffer. 


No report script disk files found. 


Appears if you try to load report scripts and the Token-Ring Monitor cannot find any 
report script files. Copy the Token-Ring Monitor sample report scripts (*.SCR) from the 
Token-Ring Monitor disk to the C:\CAPTURE\TRREPT directory. 


No statistics have been collected. 


Appears when you try to display statistics but you have not started a monitoring session. 
Start a monitoring session by pressing F10 (New monitor). 


Not a valid DOS file name. 


Appears when you try to enter a filename that contains invalid DOS characters. Try typing 
the name again, following the DOS filename requirements. 
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Send failed. 


Appears when a test frame cannot be transmitted on the network. This can be the result of 
heavy network activity or a problem with the network interface card. If this message 
appears repeatedly, run a diagnostic test on the network interface card. 


The broadcast address cannot be deleted. 
Appears if you try to delete the broadcast address. Reselect the station you want to delete. 


The current report script contains no information. Use the Report Editor to create a 
report, or load a report from a disk file. 


Appears if you try to print or save a report without first loading or editing a report script. 
Load the desired report script or create a report script. Then retry. 


The minimum filter value must be less than or equal to the maximum filter value. 


Appears if you try to enter a minimum value for a report filter that exceeds the maximum 
value. Enter a minimum filter value that is less than or equal to the maximum filter value. 


The STARTUP.TRI file has too many entries. The entries at the end of the file were not 
loaded. 


Appears if STARTUP.TRI contains more than 225 entries. 


The STARTUP.TRT file has been changed. You must unload TRMONDRV.EXE for the 
changes to take effect. 


Appears if you have used a text editor to modify STARTUP.TRT when TRMONDRYV is 
loaded. In order for the Token-Ring Monitor to use consistent SAP information, you must 
remove TRMONDRV from memory before changing STARTUP.TRT. Then restart the 
Token-Ring Monitor. 


The STARTUP.TRT file has too many entries. The entries at the end of the file were not 
loaded. 


Appears when STARTUP.TRT contains more than 32 entries. 


The STARTUP.TRT file has too many group entries. The entries at the end of the file were 
not loaded. 


Appears when STARTUP.TRT contains more than 16 SAP labels. 
The value you have entered is not valid for this item. 


Appears when you enter an invalid value. Most messages tell you the range of valid 
values; if not, try entering a lower or higher value. 


This feature is not available in the demonstration program. 


Appears if you try to use a feature not supported by the demonstration software. 


Error and Warning Messages 


This is not a Network General network card. What you are doing is illegal! 


Appears if you use the Token-Ring Monitor software with a network interface card other 
than that supplied by Network General. 


This software has been tampered with. What you have done is illegal! 


Your software has been illegally modified and executable files were corrupted. Call 
Network General for help. 


TRMONDRYV not loaded, type TRMON DEMO <SCREEN> to run the demo. 


Appears if you try to start the Token-Ring Monitor or use any of its features by entering a 
command at the DOS prompt before the TRMONDRV is loaded to memory. Start the 
Token-Ring Monitor in the foreground and select the function from its main menu. 


Unable to print alarm log, check printer. 


Appears when you try to print the alarm log and the printer does not respond. Make sure 
the printer is connected to the PC port specified by the program and that it is turned on 
and functioning properly. Then select it again. 


Write to alarm log failed. Disk full. 


Appears if the disk is full when the Token-Ring Monitor tries to add alarms to the alarm 
log on the disk. Make room by deleting other files that are not essential, such as files 
containing history statistics that you no longer need. 


Write to file failed. Disk full. 


Appears if the disk is full when you try to store a report to the disk. Make room by deleting 
other files that may not be essential, such as files containing history statistics that you no 
longer need. 


Write to history log failed. Disk full. 


Appears if the disk is full when the Token-Ring Monitor tries to store the history log to the 
disk. Remove unnecessary files from the disk to make room for the history log. 


You did not enter a file name. 
Appears if you try to store a report to the disk but have not specified the filename. 
You must load a NetWare shell before you can use this feature. 


Appears if the Token-Ring Monitor tries to perform a station test but no network interface 
cards are loaded with NetWare. Check to make sure that more than one network card is 
installed in the PC, and that one of the network cards is using NetWare. 


You must load a NetBIOS handler before you can use this feature. 


Appears if you try to use Station test with the NetBIOS or Probe for Names option and 
the Token-Ring Monitor cannot find the NetBIOS software. (You must have a second 
network interface card that runs the NetBIOS software.) If you are sure that you are 
running NetBIOS, press Enter to ignore the message. 
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You must specify a unique station. 


Appears if you try to send a test frame with either a broadcast or multicast address as the 
destination address. Select an individual station as the destination address of a test frame. 


You must stop monitoring before you can change the ring speed. 


Appears if you try to change the ring speed when a monitoring session is in progress. 
Press F10 to stop the monitoring session before changing the speed. 


You must stop monitoring before you can use this feature. 


Appears if you try to start a transmit timer or station test when a monitoring session is in 
progress. Press F10 to stop the monitoring session before starting these Token-Ring 
Monitor functions. 


You should not include a file extension. 


Appears if you include a file extension when you specify a name of a file to which a report 
is stored. 


Error and Warning Messages 


Token-Ring Monitor Warning Messages 


The following is an alphabetical listing of warning messages that appear during normal 
operation. They provide a brief explanation of the consequences of proceeding and give 
you a chance to change your mind. 


Any changes made to station alarm configurations will be lost if you proceed. 


Appears after you change threshold settings and then try to reset all thresholds to the 
default settings. 


File exists. 


Appears when you try to assign a report script filename that already exists. Unless you 
assign a different filename, the new report script overwrites the existing script. 


No Receive Signal detected. Make sure that you entered the ring at the correct speed. 


Appears if the Token-Ring Monitor enters the token-ring network at the wrong speed or 
if it is the only station on the ring. If the wrong speed has been set, stop the monitor, reset 
the speed using Option on the main menu, and restart the monitor. 


The current history statistics will be cleared if this setting is updated. 


Appears when you try to change either the station for which history statistics are collected 
or the history interval during a monitoring session. To prevent losing the statistics, print 
a report before changing these settings. 


The last line of the report script will be lost if this line is inserted. Press ENTER to proceed. 
Press ESC to cancel. 


Appears if you try to create or modify a report script to contain more than 58 lines. 


The number of stations being monitored has reached the maximum value set in the 
configuration program. You should increase this setting to make sure that all stations are 
being monitored. 


Appears when the actual number of stations on the network exceeds the value of 
Maximum Stations that you set in the Configuration Options view. The message appears 
when you use the Display command on the main menu. Adjust the setting so that all the 
stations can be monitored. 


The number of stations being monitored has reached Token-Ring Monitor's maximum value. 


Appears when more than 1,024 stations are on the network; 1,024 is the maximum number 
of stations that the Token-Ring Monitor can monitor. 


These changes will not be saved unless you enter a name for the station. 


Appears if you try to save alarm thresholds for a station that is not named. Since the 
Token-Ring Monitor considers unnamed stations as intruders, you must name all legal 
stations. 
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This selection will not take effect until the next time the collection of history statistics starts. 


Appears if you change the Align history option under History. The new setting takes 
effect at the next monitoring session. 


Token-Ring Monitor has been monitoring for more than 5 weeks. You must start a new 
monitoring session or the statistics will overflow. 


Indicates that the statistics accumulated may not be accurate due to overflow. You should 
start a new monitoring session. 


Token-Ring Monitor will stop monitoring if you proceed. 
Appears when you try to stop a monitoring session by pressing F10 (Stop monitor). 


You have not saved the latest Report Editor session. Any changes will be lost if you 
proceed. 


Appears if you try to exit Token-Ring Monitor’s main menu without saving the latest 
report script you edited. 


You must stop monitoring before you can change this filter. 


Appears if you try to change the option settings for Monitor filter when a monitoring 
session is in progress. Press F10 to stop monitoring before you change the options. 


The Sniffer Network Monitor will enter the ring at 4 MBit/s. Press ENTER to proceed. Press 
ESC to cancel. 


Appears after you pressed F10 to start a monitoring session, indicating that the Token- 
Ring Monitor is entering the token ring at 4 Mbits/second. 


The Sniffer Network Monitor will enter the ring at 16 MBit/s. Press ENTER to proceed. Press 
ESC to cancel. 


Appears after you pressed F10 to start a monitoring session, indicating that the Token- 
Ring Monitor is entering the token ring at 16 Mbits/second. 
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Appendix B. Command Line Options 


It is recommended that you invoke any of the Token-Ring Monitor functions from the 
monitor’s Selection menu or main menu. However, you can enter some Token-Ring 
Monitor commands at the DOS prompt. The following list explains each command line 
option, which follows the TRMON command you type at the DOS prompt. For example, 
you can type TRMON DEMO MONO at the C:\TRSNIFF> prompt to start the Token- 
Ring Monitor demonstration program on a monochrome display device. 


COLOR/ COLOUR 
GRAY/ GREY 
MONO 

PLASMA 

LED 

LCDR 

ALARMS 

DEMO (screen) 


HELP 


NOSCROLL 


REPORT (file) (size) 


START 


SYNOPTICS path 


Uses screen attributes for color devices. 

Uses screen attributes for Compaq® 7-level grayscale devices. 
Uses screen attributes for monochrome display devices. 

Uses screen attributes for plasma devices. 

Uses screen attributes for LCD (liquid crystal display) devices. 
Uses screen attributes for reverse LCD mode. 

Displays the contents of the alarm buffer. 


Starts the demonstration program (follow command by the 
appropriate option for your display device) 


Displays a list of command line options. 


Disables the sliding menus. You can still move from one panel to 
another to display the desired menu, but you do not see the menu 
slide on the screen. 


Displays a report on the screen (follow command by the filename 
of the report script and the page size). 


Starts anew monitoring session in the background. A DOS prompt 
appears after the monitoring session started. 


Loads the SynOptics® alias files from the specified directory. 
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Appendix C. Report Fields 


This appendix explains the meaning of each field that you can insert or edit in a report 
script. It also gives the code that represents each field. On the screen, the actual code is 
preceded and followed by the “at” sign (@). 


To display the list of report fields as shown in Figure 72, press F2 (Insert field) in a Report 
Script Editor view. This appendix describes the fields in the same order as they appear in 
Figure 72. To find out what a particular code in your report script stands for, refer to the 
list of codes at the end of this appendix. 
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Figure 72. Report fields. 


Global Fields 


The fields under the heading “Global” represent information about the entire network. 
The following list explains the meanings of the Global fields: 


Stations Number of stations. It has three options: 


Total Stations is the number of all the stations that have transmitted in the 
current monitoring session. The code is GS. 


Maximum Inserted Stns is the maximum number of stations at one time in 
the current monitoring session, whose station status is active monitor, 
standby monitor, or snooper. The code is GMI. 
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% Usage 


Frames 
Bytes 


Avg Size 


First 
Last 


Elapsed 


History 


Start 


End 


Active 
CurrTime 


FrmSizes 


Routing 


Current Inserted Stns is the number of stations whose station status is 
active monitor, standby monitor, or snooper at the time the report is 
generated. The code is GCI. 


Absolute network usage. It has two options: 


Numeric displays the percentages in numbers (without the percent sign). 
The code is GUAB. 


Graphic displays the percentages in a graph. You can select the scale used 
on the axis, which can be 0.4, 2, 10, 20, 50, or 100%. The code is GUSAGE 
ABS, which is followed by the scale. 


Total number of frames. The code is GFRAME. 
Total number of bytes. The code is GBYTE. 


Average size of the frames in the current monitoring session (total number 
of bytes divided by the total number of frames). The code is GAV. 


Time when the first network activity took place. The code is GFIRST. 
Time when the last network activity took place. The code is GLAST. 


Time elapsed between the first and last network activity. It shows the 
number of days, hours, minutes, and seconds. The code is GELAPSED. 


Global history statistics. It has two options: 


Numeric shows the history statistics in the same format as the numeric 
Global History view. The code is GHISTORY NUMERIC ABS. 


Graphic shows the history statistics in the same format as the graphic 
Global History view. You can choose the scale used on the axis, which can 
be 0.4, 2, 10, 20, 50, or 100%. The code is GHISTORY GRAPHIC ABS. 


Time the monitoring session started. The code is GMON START. 


Time the monitoring session stopped. If a monitoring session is in progress 
when the report is generated, the current time is printed. The code GMON 
END. 


Duration of the monitoring session. The code is GMON ACTIVE. 
Current time. The code is GCURRENT TIME. 


Distribution of the frame sizes. It displays the number of frames that fall in 
each size category. The format is the same as the Frame Sizes view. The 
code is GFRAME SIZES. 


Routing information. It has two options: 


Paths shows the distribution of frames according to path categories. The 
categories are listed below: 


Report Fields 


SAPs 


Error Fields 


Loc-to-Loc represents the frames that are originated from and destined for 
the local network. 


Loc-Rem represents the frames that are sent from the local network to a 
remote network. 


Rem-Loc represents the frames that are sent from a remote network to the 
local network. 


Rem-Rem represents the frames whose origin and destination are both on 
remote networks. 


Loc-Other represents the frames that are sent from the local network to a 
remote network that does not support source routing. 


Other-Loc represents the frames that are sent from a remote network that 
does not support source routing to the local network. 


The code is GROUTE.PATHS. 


Lengths shows the distribution of frames according to path length 
categories in the same format as the Routing Lengths view. The code is 
GROUTE.LENGTH. 


Distribution of traffic according to SAP types. The format is the same as the 
Protocol Types (SAPs) view. It has two options: 


Bytes shows the number of bytes for each SAP type. The code is 
GSAPS.BYTES. 


Frames shows the number of frames for each SAP type. The code is 
GSAPS.FRAMES. 


The fields under the heading “Errors” represent different types of errors on the network, 
which are the same as the ones displayed in the lower-left portion of the numeric Global 
Statistics view. The following list explains the meanings of the Error fields: 


State 
Oversize 
Purges 


SoftErrs 


Overall condition of the network. The code is ESTATE. 
Number of oversize frames. The code is EOV. 
Number of ring purges. The code is EPU. 


Number of soft errors. The code is ESO. 
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Station Fields 


The fields under the heading “Station” represent station information. The following list 
explains the meanings of the Station fields: 


Sort Pos 
Address 
Name 
Status 


Text 


CSV Ret 


Sort position of the station. The code is SS. 
Station address. The code is SADDRESS. 
Station name. The code is SNAME. 
Station status. The code is SSTATUS. 


Text characters. If you want to have characters separating two entries in the 
report, position the cursor below the line that represents an entry in the 
script, type the character and insert Text. The character is printed below 
each entry in the generated report, and is replicated four times. For 
example, if you want to print ##### between each pair of entries in the 
generated report, type # and select Text. The character and the code appear 
in the report script as #@ST@. If no character precedes the field, the report 
assumes that character to be a blank, and a blank line appears in the 
generated report where you insert Text. 


Carriage return in a report script with CSV format. Use this field if the 
report contains lines that exceed the maximum width of the script (80 
characters). The report suppresses a linefeed where you insert this field. 
For example, your report contains four fields, each of which has 30 
characters. If you insert CSV Ret after the second field, the third and fourth 
fields are printed on the same line as the first two in the generated report. 
Although the total length of the fields exceeds the width of the report 
script, they are interpreted as one entry when the report is imported into a 
spreadsheet program. The code is SC. 


From, To, and Both Fields 


The headings “From,” “To,” and “Both” represent the class of traffic. The fields under the 
headings “From” and “To” are related to traffic transmitted and received by each station 
in the report. The fields under the heading “Both” are related to the traffic both 
transmitted and received by the stations. The following list explains the meanings of the 
fields under these headings. The term “this station” refers to the station that is displayed 
as a report entry. 


Partner 


When used as a From field, Partner is the name of the station that this 
station most recently received traffic from. The code is FPARTNER. 


When used as a To field, Partner is the name of the station that this station 
most recently transmitted traffic to. The code is TPARTNER. 


When used as a Both field, Partner is the name of the station that this 
station most recently transmitted traffic to or received traffic from. The 
code is BPARTNER. 
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% Usage 


Frames 


Errors 


Bytes 


Report Fields 


When used as a From field, % Usage is the network usage caused by the 
amount of traffic transmitted from this station. 


When used as a To field, % Usage is the network usage caused by the 
amount of traffic sent to this station. 


When used as a Both field, % Usage is the network usage caused by traffic 
that is sent from and to this station. 


Regardless of the class of traffic, the % Usage field has these options: 


Absolute represents the absolute network usage; Relative represents the 
relative network usage. 


Numeric displays the network usage in numbers (without the percent 
sign). Graphic displays the network usage in a graph. You can choose the 
scale for the axis, which can be 0.4, 2, 10, 20, 50, or 100%. 


The following table lists the codes used for this field. 


From To Both 
Numeric 
Absolute FUAB TUAB BUAB 
Relative FURE TURE BURE 
Graphic 


Absolute FUSAGE ABS TUSAGEABS ~~ BUSAGE ABS 
Relative FUSAGE REL TUSAGEREL BUSAGE REL 


When used as a From field, Frames is the number of frames sent from this 
station. The code is FFRAME. 


When used asa To field, Frames is the number of frames sent to this station. 
The code is TFRAME. 


When used as a Both field, Frames is the number of frames sent from and 
to this station. The code is BFRAME. 


Whether Errors is used as a From or Both field, it is the number of soft error 
report frames sent from this station. This field does not exist as a To field. 
The codes are FER and BER for the From field and Both field, respectively. 


When used as a From field, Bytes is the number of bytes sent from this 
station. The code is FBYTE. 


When used as a To field, Bytes is the number of bytes sent to this station. 
The code is TBYTE. 


When used as a Both field, Bytes is the number of bytes sent to and from 
this station. The code is BBYTE. 
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Avg Size 


First 


Last 


Elapsed 


History 


When used as a From field, Avg Size is the average size of the frames sent 
from this station. The code is FAV. 


When used as a To field, Avg Size is the average size of the frames sent to 
this station. The code is TAV. 


When used as a Both field, Avg Size is the average size of the frames sent 
to and from this station. The code is BAV. 


When used as a From field, First is the time when this station first sent out 
traffic during the current monitoring session. The code is FFIRST. 


When used as a To field, First is the time when this station first received 
traffic during the current monitoring session. The code is TFIRST. 


When used as a Both field, First is the time when this station first received 
or sent traffic during the current monitoring session. The code is BFIRST. 


When used asa From field, Last is the time when this station made the most 
recent transmission. The code is FLAST. 


When used as a To field, Last is the time when the Token-Ring Monitor 
detected the last frame containing this station’s address as the destination 
address. The code is TLAST. 


When used asa Both field, Last is the time when this station made the most 
recent transmission or when the Token-Ring Monitor detected the last 
frame containing this station’s address as the destination address. The code 
is BLAST. 


When used as a From field, Elapsed is the length of time between the 
station’s first and last transmission in the current monitoring session. The 
code is FELAPSED. 


When used as a To field, Elapsed is the length of time between the Token- 
Ring Monitor's first and last detection of the station’s address as a 
destination address. The code is TELAPSED. 


When used asa Both field, Elapsed is the length of the time period between 
the station’s first and last network activity, which can be a transmission or 
reception. The code is BELAPSED. 


Displays the station’s history statistics in the same format as the statistics 
view generated by Station history on the Token-Ring Monitor’s main 
menu. 


When used as a From field, the display includes the number of frames sent 
from this station. The code is FHISTORY. 


When used as a To field, the display includes the number of frames sent to 
this station. The code is THISTORY. 


When used as a Both field, the display includes the number of frames both 
sent to and from this station. The code is BHISTORY. 


Report Fields 


This field has several options: 


Absolute means that all network usage percentages in the report are 
absolute; Relative means that all network usage percentages in the report 
are relative. The codes are ABS and REL for Absolute and Relative, 


respectively. 


Numeric displays the station history statistics in numbers. The code is 
NUMERIC. Graphic displays the statistics in a graph. You can choose the 
scale for the axis, which can be 0.4, 2, 10, 20, 50, or 100%. The code is 


GRAPHIC. 


In the report, the codes for the options are concatenated to forma single 
code. For example, if you select History as a To field, and Numeric and 
Absolute as the options, the code for the field is THISTORY NUMERIC 


ABS. 


List of Codes 


Both 


This section lists all the codes alphabetically that can appear in a report script. They are 
arranged according to the fields under which they appear. 


Code 

BAV 

BBYTE 

BELAPSED 

BER 

BFIRST 

BFRAME 

BHISTORY GRAPHIC ABS 
BHISTORY GRPHIC REL 
BHISTORY NUMERIC ABS 
BHISTORY NUMERIC REL 
BLAST 

BPARTNER 

BUAB 

BURE 


BUSAGE ABS 


Report Field 

Avg Size 

Bytes 

Elapsed 

Errors 

First 

Frames 

History (Absolute, Graphic) 
History (Relative, Graphic) 
History (Absolute, Numeric) 
History (Relative, Numeric) 
Last 

Partner 

% Usage (Absolute, Numeric) 
% Usage (Relative, Numeric) 


% Usage (Absolute, Graphic) 
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Errors 


From 


Global 
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BUSAGE REL 


Code 
EOV 
EPU 
ESO 
ESTATE 


Code 

FAV 

FBYTE 

FELAPSED 

FER 

PFIRST 

FFRAME 

FHISTORY GRAPHIC ABS 
FHISTORY GRPHIC REL 
FHISTORY NUMERIC ABS 
FHISTORY NUMERIC REL 
PLAST 

FPARTNER 

FUAB 

FURE 

FUSAGE ABS 

PUSAGE REL 


Code 
GAV 


% Usage (Relative, Graphic) 


Report Field 
Oversize 
Purges 
SoftErrs 


State 


Report Field 

Avg Size 

Bytes 

Elapsed 

Errors 

First 

Frames 

History (Absolute, Graphic) 
History (Relative, Graphic) 
History (Absolute, Numeric) 
History (Relative, Numeric) 
Last 

Partner 

% Usage (Absolute, Numeric) 
% Usage (Relative, Numeric) 
% Usage (Absolute, Graphic) 


% Usage (Relative, Graphic) 


Report Field 


Avg Size 


Station 


GBYTE 

GCI 

GCURRENT TIME 
GELAPSED 

GFIRST 

GFRAME 

GFRAME SIZES 
GHISTORY GRAPHIC ABS 
GHISTORY NUMERIC ABS 
GLAST 

GMI 

GMON ACTIVE 
GMON END 
GMON START 
GROUTE.LENGTHS 
GROUTE.PATHS 
GS 

GSAPS.BYTES 
GSAPS.FRAME 
GUAB 

GUSAGE ABS 


Code 
SADDRESS 
sa 

SNAME 

55 
SSTATUS 
aT 


Report Fields 


Bytes 

Stations (Current Inserted Stns) 
CurrTime 

Elapsed 

First 

Frames 

FrmSizes 

History (Graphic) 
History (Numeric) 

Last 

Stations (Maximum Inserted Stns) 
Active 

End 

Start 

Routing (Lengths) 
Routing (Paths) 
Stations (Total Stations) 
SAPs (Bytes) 

SAPs (Frames) 

% Usage (Numeric) 

% Usage (Graphic) 


Report Field 
Address 
CSV RET 
Name 

Sort Pos 
Status 


Text 
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To 
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Code 

TAV 

TBYTE 

TELAPSED 

TFIRST 

TFRAME 

THISTORY GRAPHIC ABS 
THISTORY GRPHIC REL 
THISTORY NUMERIC ABS 
THISTORY NUMERIC REL 
TLAST 

TPARTNER 

TUAB 

TURE 

TUSAGE ABS 


TUSAGE REL 


Report Field 

Avg Size 

Bytes 

Elapsed 

First 

Frames 

History (Absolute, Graphic) 
History (Relative, Graphic) 
History (Absolute, Numeric) 
History (Relative, Numeric) 
Last 

Partner 

% Usage (Absolute, Numeric) 
% Usage (Relative, Numeric) 


% Usage (Absolute, Graphic) 


% Usage (Relative, Graphic) 
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Traffic counts 

numeric Global Statistics view, 49, 140 
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Transmit timer, 125, 126, 135 
Transmit Wait Time view, 135 
TRMON, 129 
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